<2019年10月>
293012345
6789101112
13141516171819
20212223242526
272829303112
3456789

文章分类

导航

订阅

KeBugCheck2的第6个参数

大家知道,DDK公开了两个内核API用于产生BSOD,分别是KeBugCheck()和KeBugCheckEx()。其原型分别如下:

VOID
  KeBugCheck(
IN ULONG  BugCheckCode
    );

VOID
  KeBugCheckEx(
IN ULONG BugCheckCode,
    IN ULONG_PTR  BugCheckParameter1,
    IN ULONG_PTR  BugCheckParameter2,
    IN ULONG_PTR  BugCheckParameter3,
    IN ULONG_PTR  BugCheckParameter4
    );

在内部,KebugCheck只是简单的调用KebugCheckEx,将BugCheckCode传递给后者,其它参数都传为空。

在Windows XP之前,KeBugCheckEx()是真正的BSOD发射地,根据BugCheckCode作了一系列准备工作后,便提高IRQL,禁止中断,然后调用Boot Video驱动绘制蓝屏了!

nt!InbvAcquireDisplayOwnership (8052d5db)
nt!InbvResetDisplay (8052d40d)
nt!InbvSolidColorFill (8052d491)
nt!InbvSetTextColor (8052d51f)

但从Windows XP开始,KeBugCheckEx也“升职加薪”不作具体事务了。它只是简单的调用KebugCheck2。

nt!KeBugCheckEx:
8052b578 55               push    ebp
8052b579 8bec             mov     ebp,esp
8052b57b 6a00             push    0x0
8052b57d ff7518           push    dword ptr [ebp+0x18]
8052b580 ff7514           push    dword ptr [ebp+0x14]
8052b583 ff7510           push    dword ptr [ebp+0x10]
8052b586 ff750c           push    dword ptr [ebp+0xc]
8052b589 ff7508           push    dword ptr [ebp+0x8]
8052b58c e864f5ffff       call    nt!KeBugCheck2 (8052aaf5)
8052b591 5d               pop     ebp
8052b592 c21400           ret     0x14

微软至今尚未公开KebugCheck2的原型,但是有一点可以肯定,KebugCheck2比KeBugCheckEx多了一个参数。因此其原型大致如下(猜测):

VOID
  KeBugCheck2(
IN ULONG BugCheckCode,
    IN ULONG_PTR  BugCheckParameter1,
    IN ULONG_PTR  BugCheckParameter2,
    IN ULONG_PTR  BugCheckParameter3,
    IN ULONG_PTR  BugCheckParameter4,
    IN ULONG_PTR  BugCheckParameterNew
    );

那么这个新的参数BugCheckParameterNew的作用是什么呢?看以下的汇编代码,指导其先被赋给了一个局部变量ebp-0x3b8

kd> uf nt!KeBugCheck2
nt!KeBugCheck2:
80532e4a 8bff             mov     edi,edi
80532e4c 55               push    ebp
80532e4d 8bec             mov     ebp,esp
80532e4f 81ecc8030000     sub     esp,0x3c8
80532e55 a1201a5580       mov     eax,[nt!__security_cookie (80551a20)]
80532e5a 8945fc           mov     [ebp-0x4],eax
80532e5d 8b450c           mov     eax,[ebp+0xc]
80532e60 898544fcffff     mov     [ebp-0x3bc],eax
80532e66 8b4514           mov     eax,[ebp+0x14]
80532e69 89855cfcffff     mov     [ebp-0x3a4],eax
80532e6f 8b4518           mov     eax,[ebp+0x18]
80532e72 53               push    ebx
80532e73 8b5d10           mov     ebx,[ebp+0x10]
80532e76 33c9             xor     ecx,ecx
80532e78 89853cfcffff     mov     [ebp-0x3c4],eax
80532e7e 8b451c           mov     eax,[ebp+0x1c]
80532e81 56               push    esi
80532e82 57               push    edi
80532e83 899d38fcffff     mov     [ebp-0x3c8],ebx
80532e89 898558fcffff     mov     [ebp-0x3a8],eax
80532e8f 898d48fcffff     mov     [ebp-0x3b8],ecx
80532e95 898d4cfcffff     mov     [ebp-0x3b4],ecx
80532e9b 898d54fcffff     mov     [ebp-0x3ac],ecx
80532ea1 64a124010000     mov     eax,fs:[00000124]
80532ea7 817d08e5000000   cmp     dword ptr [ebp+0x8],0xe5
80532eae 898540fcffff     mov     [ebp-0x3c0],eax
80532eb4 888d61fcffff     mov     [ebp-0x39f],cl
80532eba 888d63fcffff     mov     [ebp-0x39d],cl
80532ec0 890d00a55580     mov     [nt!KiBugCheckDriver (8055a500)],ecx
80532ec6 750d             jnz     nt!KeBugCheck2+0x8b (80532ed5)

nt!KeBugCheck2+0x7e:
80532ec8 e85efdffff       call    nt!KiScanBugCheckCallbackList (80532c2b)
80532ecd 6a03             push    0x3
80532ecf ff15ac754d80 call dword ptr [nt!_imp__HalReturnToFirmware (804d75ac)]

nt!KeBugCheck2+0x8b:
80532ed5 e808fafaff       call    nt!KiSetHardwareTrigger (804e28e2)
80532eda 3ea120f0dfff     mov     eax,ds:[ffdff020]
80532ee0 83c01c           add     eax,0x1c
80532ee3 50               push    eax
80532ee4 e89a8bfaff       call    nt!RtlCaptureContext (804dba83)
80532ee9 3ea120f0dfff     mov     eax,ds:[ffdff020]
80532eef 83c01c           add     eax,0x1c
80532ef2 50               push    eax
80532ef3 e89931fbff       call    nt!KiSaveProcessorControlState (804e6091)
80532ef8 3ea120f0dfff     mov     eax,ds:[ffdff020]
80532efe 837d087f         cmp     dword ptr [ebp+0x8],0x7f
80532f02 8d701c           lea     esi,[eax+0x1c]
80532f05 b9b3000000       mov     ecx,0xb3
80532f0a 8dbd64fcffff     lea     edi,[ebp-0x39c]
80532f10 6a1e             push    0x1e
80532f12 f3a5             rep     movsd
80532f14 b8c5000000       mov     eax,0xc5
80532f19 59               pop     ecx
80532f1a 0f87fa000000     jnbe    nt!KeBugCheck2+0x1d0 (8053301a)

nt!KeBugCheck2+0xd6:
80532f20 8b4508           mov     eax,[ebp+0x8]
80532f23 83f87f           cmp     eax,0x7f
80532f26 0f844b010000     je      nt!KeBugCheck2+0x22d (80533077)

nt!KeBugCheck2+0xe2:
80532f2c 2bc1             sub     eax,ecx
80532f2e 7434             jz      nt!KeBugCheck2+0x11a (80532f64)

nt!KeBugCheck2+0xe6:
80532f30 83e805           sub     eax,0x5
80532f33 0f843e010000     je      nt!KeBugCheck2+0x22d (80533077)

nt!KeBugCheck2+0xef:
80532f39 48               dec     eax
80532f3a 0f84cb000000     je      nt!KeBugCheck2+0x1c1 (8053300b)

nt!KeBugCheck2+0xf6:
80532f40 83e80a           sub     eax,0xa
80532f43 0f842e010000     je      nt!KeBugCheck2+0x22d (80533077)

nt!KeBugCheck2+0xff:
80532f49 83e811           sub     eax,0x11
80532f4c 0f8425010000     je      nt!KeBugCheck2+0x22d (80533077)

nt!KeBugCheck2+0x108:
80532f52 83e83c           sub     eax,0x3c
80532f55 0f841c010000     je      nt!KeBugCheck2+0x22d (80533077)

nt!KeBugCheck2+0x111:
80532f5b 83e803           sub     eax,0x3
80532f5e 0f85f5000000     jne     nt!KeBugCheck2+0x20f (80533059)

nt!KeBugCheck2+0x11a:
80532f64 898d50fcffff     mov     [ebp-0x3b0],ecx

nt!KeBugCheck2+0x120:
80532f6a 8b4508           mov     eax,[ebp+0x8]

nt!KeBugCheck2+0x120:
80532f6a 8b4508           mov     eax,[ebp+0x8]

nt!KeBugCheck2+0x123:
80532f6d 8bb544fcffff     mov     esi,[ebp-0x3bc]
80532f73 8b955cfcffff     mov     edx,[ebp-0x3a4]
80532f79 8b8d3cfcffff     mov     ecx,[ebp-0x3c4]
80532f7f a320a55580       mov     [nt!KiBugCheckData (8055a520)],eax
80532f84 b8be000000       mov     eax,0xbe
80532f89 394508           cmp     [ebp+0x8],eax
80532f8c 893524a55580     mov     [nt!KiBugCheckData+0x4 (8055a524)],esi
80532f92 891d28a55580     mov     [nt!KiBugCheckData+0x8 (8055a528)],ebx
80532f98 89152ca55580     mov     [nt!KiBugCheckData+0xc (8055a52c)],edx
80532f9e 890d30a55580     mov     [nt!KiBugCheckData+0x10 (8055a530)],ecx
80532fa4 0f87f5020000     jnbe    nt!KeBugCheck2+0x455 (8053329f)

nt!KeBugCheck2+0x160:
80532faa 7427             jz      nt!KeBugCheck2+0x189 (80532fd3)

nt!KeBugCheck2+0x162:
80532fac 8b4508           mov     eax,[ebp+0x8]
80532faf 83e80a           sub     eax,0xa
80532fb2 0f840c020000     je      nt!KeBugCheck2+0x37a (805331c4)

nt!KeBugCheck2+0x16e:
80532fb8 83e842           sub     eax,0x42
80532fbb 0f84c6010000     je      nt!KeBugCheck2+0x33d (80533187)

nt!KeBugCheck2+0x177:
80532fc1 83e804           sub     eax,0x4
80532fc4 0f84bb000000     je      nt!KeBugCheck2+0x23b (80533085)

nt!KeBugCheck2+0x180:
80532fca 83e83e           sub     eax,0x3e
80532fcd 0f85f9020000     jne     nt!KeBugCheck2+0x482 (805332cc)

nt!KeBugCheck2+0x189:
80532fd3 83bd58fcffff00   cmp     dword ptr [ebp-0x3a8],0x0
80532fda 750e             jnz     nt!KeBugCheck2+0x1a0 (80532fea)

nt!KeBugCheck2+0x192:
80532fdc 85d2             test    edx,edx
80532fde 0f84e8020000     je      nt!KeBugCheck2+0x482 (805332cc)

nt!KeBugCheck2+0x19a:
80532fe4 899558fcffff     mov     [ebp-0x3a8],edx

nt!KeBugCheck2+0x1a0:
80532fea 817d088e000000   cmp     dword ptr [ebp+0x8],0x8e
80532ff1 0f84d5020000     je      nt!KeBugCheck2+0x482 (805332cc)

nt!KeBugCheck2+0x1ad:
80532ff7 8b8558fcffff     mov     eax,[ebp-0x3a8]
80532ffd 8b4068           mov     eax,[eax+0x68]
80533000 898554fcffff     mov     [ebp-0x3ac],eax
80533006 e9c1020000       jmp     nt!KeBugCheck2+0x482 (805332cc)

nt!KeBugCheck2+0x1c1:
8053300b c78550fcffff23000000 mov dword ptr [ebp-0x3b0],0x23
80533015 e950ffffff       jmp     nt!KeBugCheck2+0x120 (80532f6a)

nt!KeBugCheck2+0x1d0:
8053301a 817d088e000000   cmp     dword ptr [ebp+0x8],0x8e
80533021 0f843dffffff     je      nt!KeBugCheck2+0x11a (80532f64)

nt!KeBugCheck2+0x1dd:
80533027 817d08a5000000   cmp     dword ptr [ebp+0x8],0xa5
8053302e 7447             jz      nt!KeBugCheck2+0x22d (80533077)

nt!KeBugCheck2+0x1e6:
80533030 394508           cmp     [ebp+0x8],eax
80533033 7442             jz      nt!KeBugCheck2+0x22d (80533077)

nt!KeBugCheck2+0x1eb:
80533035 817d08d0000000   cmp     dword ptr [ebp+0x8],0xd0
8053303c 743c             jz      nt!KeBugCheck2+0x230 (8053307a)

nt!KeBugCheck2+0x1f4:
8053303e 817d08e0000000   cmp     dword ptr [ebp+0x8],0xe0
80533045 7430             jz      nt!KeBugCheck2+0x22d (80533077)

nt!KeBugCheck2+0x1fd:
80533047 817d08ea000000   cmp     dword ptr [ebp+0x8],0xea
8053304e 7427             jz      nt!KeBugCheck2+0x22d (80533077)

nt!KeBugCheck2+0x206:
80533050 817d08d10200c0   cmp     dword ptr [ebp+0x8],0xc00002d1
80533057 740f             jz      nt!KeBugCheck2+0x21e (80533068)

nt!KeBugCheck2+0x20f:
80533059 c78550fcffff82000040 mov dword ptr [ebp-0x3b0],0x40000082
80533063 e902ffffff       jmp     nt!KeBugCheck2+0x120 (80532f6a)

nt!KeBugCheck2+0x21e:
80533068 c78550fcffffc3000000 mov dword ptr [ebp-0x3b0],0xc3
80533072 e9f3feffff       jmp     nt!KeBugCheck2+0x120 (80532f6a)

nt!KeBugCheck2+0x22d:
80533077 8b4508           mov     eax,[ebp+0x8]

nt!KeBugCheck2+0x230:
8053307a 898550fcffff     mov     [ebp-0x3b0],eax
80533080 e9e5feffff       jmp     nt!KeBugCheck2+0x120 (80532f6a)

nt!KeBugCheck2+0x23b:
80533085 83a55cfcffff00   and     dword ptr [ebp-0x3a4],0x0
8053308c 83bd58fcffff00   cmp     dword ptr [ebp-0x3a8],0x0
80533093 750a             jnz     nt!KeBugCheck2+0x255 (8053309f)

nt!KeBugCheck2+0x24b:
80533095 85d2             test    edx,edx
80533097 743f             jz      nt!KeBugCheck2+0x28e (805330d8)

nt!KeBugCheck2+0x24f:
80533099 899558fcffff     mov     [ebp-0x3a8],edx

nt!KeBugCheck2+0x255:
8053309f 8b8558fcffff     mov     eax,[ebp-0x3a8]
805330a5 8b7068           mov     esi,[eax+0x68]
805330a8 8d8562fcffff     lea     eax,[ebp-0x39e]
805330ae 50               push    eax
805330af 6a00             push    0x0
805330b1 8d855cfcffff     lea     eax,[ebp-0x3a4]
805330b7 50               push    eax
805330b8 56               push    esi
805330b9 89b554fcffff     mov     [ebp-0x3ac],esi
805330bf 89352ca55580     mov     [nt!KiBugCheckData+0xc (8055a52c)],esi
805330c5 e8d8f8ffff       call    nt!KiPcToFileHeader (805329a2)
805330ca 8a9d62fcffff     mov     bl,[ebp-0x39e]
805330d0 89855cfcffff     mov     [ebp-0x3a4],eax
805330d6 eb08             jmp     nt!KeBugCheck2+0x296 (805330e0)

nt!KeBugCheck2+0x28e:
805330d8 8bb554fcffff     mov     esi,[ebp-0x3ac]
805330de b301             mov     bl,0x1

nt!KeBugCheck2+0x296:
805330e0 8bbd44fcffff     mov     edi,[ebp-0x3bc]
805330e6 57               push    edi
805330e7 e88f720000       call    nt!MmIsSpecialPoolAddress (8053a37b)
805330ec 83f801           cmp     eax,0x1
805330ef 7534             jnz     nt!KeBugCheck2+0x2db (80533125)

nt!KeBugCheck2+0x2a7:
805330f1 57               push    edi
805330f2 e8b1720000       call    nt!MmIsSpecialPoolAddressFree (8053a3a8)
805330f7 fecb             dec     bl
805330f9 83f801           cmp     eax,0x1
805330fc 750f             jnz     nt!KeBugCheck2+0x2c3 (8053310d)

nt!KeBugCheck2+0x2b4:
805330fe f6db             neg     bl
80533100 1bdb             sbb     ebx,ebx
80533102 83e309           and     ebx,0x9
80533105 81c3cc000000     add     ebx,0xcc
8053310b eb0d             jmp     nt!KeBugCheck2+0x2d0 (8053311a)

nt!KeBugCheck2+0x2c3:
8053310d f6db             neg     bl
8053310f 1bdb             sbb     ebx,ebx
80533111 83e309           and     ebx,0x9
80533114 81c3cd000000     add     ebx,0xcd

nt!KeBugCheck2+0x2d0:
8053311a 891d20a55580     mov     [nt!KiBugCheckData (8055a520)],ebx
80533120 e9a7010000       jmp     nt!KeBugCheck2+0x482 (805332cc)

nt!KeBugCheck2+0x2db:
80533125 3bf7             cmp     esi,edi
80533127 752f             jnz     nt!KeBugCheck2+0x30e (80533158)

nt!KeBugCheck2+0x2df:
80533129 57               push    edi
8053312a e83a91fdff       call    nt!MmIsSessionAddress (8050c269)
8053312f 83f801           cmp     eax,0x1
80533132 7524             jnz     nt!KeBugCheck2+0x30e (80533158)

nt!KeBugCheck2+0x2ea:
80533134 8b8540fcffff     mov     eax,[ebp-0x3c0]
8053313a 8b4020           mov     eax,[eax+0x20]
8053313d 85c0             test    eax,eax
8053313f 7408             jz      nt!KeBugCheck2+0x2ff (80533149)

nt!KeBugCheck2+0x2f7:
80533141 3b0538f55580     cmp     eax,[nt!MmSystemRangeStart (8055f538)]
80533147 720f             jb      nt!KeBugCheck2+0x30e (80533158)

nt!KeBugCheck2+0x2ff:
80533149 c70520a55580cf000000 mov dword ptr [nt!KiBugCheckData (8055a520)],0xcf
80533153 e974010000       jmp     nt!KeBugCheck2+0x482 (805332cc)

nt!KeBugCheck2+0x30e:
80533158 83bd5cfcffff00   cmp     dword ptr [ebp-0x3a4],0x0
8053315f 0f8567010000     jne     nt!KeBugCheck2+0x482 (805332cc)

nt!KeBugCheck2+0x31b:
80533165 57               push    edi
80533166 e8454c0000       call    nt!MmLocateUnloadedDriver (80537db0)
8053316b 85c0             test    eax,eax
8053316d a300a55580       mov     [nt!KiBugCheckDriver (8055a500)],eax
80533172 0f846d010000     je      nt!KeBugCheck2+0x49b (805332e5)

nt!KeBugCheck2+0x32e:
80533178 c70520a55580ce000000 mov dword ptr [nt!KiBugCheckData (8055a520)],0xce
80533182 e945010000       jmp     nt!KeBugCheck2+0x482 (805332cc)

nt!KeBugCheck2+0x33d:
80533187 893520a55580     mov     [nt!KiBugCheckData (8055a520)],esi
8053318d 8b03             mov     eax,[ebx]
8053318f a324a55580       mov     [nt!KiBugCheckData+0x4 (8055a524)],eax
80533194 8b4304           mov     eax,[ebx+0x4]
80533197 a328a55580       mov     [nt!KiBugCheckData+0x8 (8055a528)],eax
8053319c 8b4308           mov     eax,[ebx+0x8]
8053319f a32ca55580       mov     [nt!KiBugCheckData+0xc (8055a52c)],eax
805331a4 8b430c           mov     eax,[ebx+0xc]
805331a7 c68561fcffff01   mov     byte ptr [ebp-0x39f],0x1
805331ae 899548fcffff     mov     [ebp-0x3b8],edx
805331b4 898d4cfcffff     mov     [ebp-0x3b4],ecx
805331ba a330a55580       mov     [nt!KiBugCheckData+0x10 (8055a530)],eax
805331bf e908010000       jmp     nt!KeBugCheck2+0x482 (805332cc)

nt!KeBugCheck2+0x37a:
805331c4 3b0d8cab5580     cmp     ecx,[nt!ExPoolCodeStart (8055ab8c)]
805331ca 7217             jb      nt!KeBugCheck2+0x399 (805331e3)

nt!KeBugCheck2+0x382:
805331cc 3b0d88ab5580     cmp     ecx,[nt!ExPoolCodeEnd (8055ab88)]
805331d2 730f             jnb     nt!KeBugCheck2+0x399 (805331e3)

nt!KeBugCheck2+0x38a:
805331d4 c70520a55580c5000000 mov dword ptr [nt!KiBugCheckData (8055a520)],0xc5
805331de e9b3000000       jmp     nt!KeBugCheck2+0x44c (80533296)

nt!KeBugCheck2+0x399:
805331e3 3b0d84ab5580     cmp     ecx,[nt!MmPoolCodeStart (8055ab84)]
805331e9 7217             jb      nt!KeBugCheck2+0x3b8 (80533202)

nt!KeBugCheck2+0x3a1:
805331eb 3b0d80ab5580     cmp     ecx,[nt!MmPoolCodeEnd (8055ab80)]
805331f1 730f             jnb     nt!KeBugCheck2+0x3b8 (80533202)

nt!KeBugCheck2+0x3a9:
805331f3 c70520a55580d0000000 mov dword ptr [nt!KiBugCheckData (8055a520)],0xd0
805331fd e994000000       jmp     nt!KeBugCheck2+0x44c (80533296)

nt!KeBugCheck2+0x3b8:
80533202 3b0d7cab5580     cmp     ecx,[nt!MmPteCodeStart (8055ab7c)]
80533208 7214             jb      nt!KeBugCheck2+0x3d4 (8053321e)

nt!KeBugCheck2+0x3c0:
8053320a 3b0d78ab5580     cmp     ecx,[nt!MmPteCodeEnd (8055ab78)]
80533210 730c             jnb     nt!KeBugCheck2+0x3d4 (8053321e)

nt!KeBugCheck2+0x3c8:
80533212 c70520a55580db000000 mov dword ptr [nt!KiBugCheckData (8055a520)],0xdb
8053321c eb78             jmp     nt!KeBugCheck2+0x44c (80533296)

nt!KeBugCheck2+0x3d4:
8053321e 8d8562fcffff     lea     eax,[ebp-0x39e]
80533224 50               push    eax
80533225 6a00             push    0x0
80533227 8d855cfcffff     lea     eax,[ebp-0x3a4]
8053322d 50               push    eax
8053322e 51               push    ecx
8053322f e86ef7ffff       call    nt!KiPcToFileHeader (805329a2)
80533234 80bd62fcffff01   cmp     byte ptr [ebp-0x39e],0x1
8053323b 754f             jnz     nt!KeBugCheck2+0x442 (8053328c)

nt!KeBugCheck2+0x3f3:
8053323d 8d8562fcffff     lea     eax,[ebp-0x39e]
80533243 50               push    eax
80533244 6a01             push    0x1
80533246 8d855cfcffff     lea     eax,[ebp-0x3a4]
8053324c 50               push    eax
8053324d 56               push    esi
8053324e e84ff7ffff       call    nt!KiPcToFileHeader (805329a2)
80533253 85c0             test    eax,eax
80533255 741a             jz      nt!KeBugCheck2+0x427 (80533271)

nt!KeBugCheck2+0x40d:
80533257 8b855cfcffff     mov     eax,[ebp-0x3a4]
8053325d 83c02c           add     eax,0x2c
80533260 a300a55580       mov     [nt!KiBugCheckDriver (8055a500)],eax
80533265 c70520a55580d3000000 mov dword ptr [nt!KiBugCheckData (8055a520)],0xd3
8053326f eb25             jmp     nt!KeBugCheck2+0x44c (80533296)

nt!KeBugCheck2+0x427:
80533271 56               push    esi
80533272 e8394b0000       call    nt!MmLocateUnloadedDriver (80537db0)
80533277 85c0             test    eax,eax
80533279 a300a55580       mov     [nt!KiBugCheckDriver (8055a500)],eax
8053327e 7416             jz      nt!KeBugCheck2+0x44c (80533296)

nt!KeBugCheck2+0x436:
80533280 c70520a55580d4000000 mov dword ptr [nt!KiBugCheckData (8055a520)],0xd4
8053328a eb0a             jmp     nt!KeBugCheck2+0x44c (80533296)

nt!KeBugCheck2+0x442:
8053328c c70520a55580d1000000 mov dword ptr [nt!KiBugCheckData (8055a520)],0xd1

nt!KeBugCheck2+0x44c:
80533296 83a554fcffff00   and     dword ptr [ebp-0x3ac],0x0
8053329d eb2d             jmp     nt!KeBugCheck2+0x482 (805332cc)

nt!KeBugCheck2+0x455:
8053329f 8b4508           mov     eax,[ebp+0x8]
805332a2 2dcb000000       sub     eax,0xcb
805332a7 741d             jz      nt!KeBugCheck2+0x47c (805332c6)

nt!KeBugCheck2+0x45f:
805332a9 83e80d           sub     eax,0xd
805332ac 740d             jz      nt!KeBugCheck2+0x471 (805332bb)

nt!KeBugCheck2+0x464:
805332ae 83e812           sub     eax,0x12
805332b1 7519             jnz     nt!KeBugCheck2+0x482 (805332cc)

nt!KeBugCheck2+0x469:
805332b3 891500a55580     mov     [nt!KiBugCheckDriver (8055a500)],edx
805332b9 eb11             jmp     nt!KeBugCheck2+0x482 (805332cc)

nt!KeBugCheck2+0x471:
805332bb 83c62c           add     esi,0x2c
805332be 893500a55580     mov     [nt!KiBugCheckDriver (8055a500)],esi
805332c4 eb06             jmp     nt!KeBugCheck2+0x482 (805332cc)

nt!KeBugCheck2+0x47c:
805332c6 89b554fcffff     mov     [ebp-0x3ac],esi

nt!KeBugCheck2+0x482:
805332cc a100a55580       mov     eax,[nt!KiBugCheckDriver (8055a500)]
805332d1 85c0             test    eax,eax
805332d3 7410             jz      nt!KeBugCheck2+0x49b (805332e5)

nt!KeBugCheck2+0x48b:
805332d5 6a64             push    0x64
805332d7 8d4d98           lea     ecx,[ebp-0x68]
805332da 51               push    ecx
805332db 50               push    eax
805332dc e8aef5ffff       call    nt!KeBugCheckUnicodeToAnsi (8053288f)
805332e1 33f6             xor     esi,esi
805332e3 eb21             jmp     nt!KeBugCheck2+0x4bc (80533306)

nt!KeBugCheck2+0x49b:
805332e5 33f6             xor     esi,esi
805332e7 39b554fcffff     cmp     [ebp-0x3ac],esi
805332ed 7417             jz      nt!KeBugCheck2+0x4bc (80533306)

nt!KeBugCheck2+0x4a5:
805332ef 688f285380       push    0x8053288f
805332f4 6a01             push    0x1
805332f6 8d8554fcffff     lea     eax,[ebp-0x3ac]
805332fc 50               push    eax
805332fd 8d4598           lea     eax,[ebp-0x68]
80533300 50               push    eax
80533301 e823f7ffff       call    nt!KiDumpParameterImages (80532a29)

nt!KeBugCheck2+0x4bc:
80533306 803d7ccb548000   cmp    byte ptr [nt!KdPitchDebugger (8054cb7c)],0x0
8053330d 7511             jnz     nt!KeBugCheck2+0x4d6 (80533320)

nt!KeBugCheck2+0x4c5:
8053330f 8d8564fcffff     lea     eax,[ebp-0x39c]
80533315 a388c75480       mov    [nt!KdDebuggerDataBlock+0x28 (8054c788)],eax
8053331a 89358cc75480     mov    [nt!KdDebuggerDataBlock+0x2c (8054c78c)],esi

nt!KeBugCheck2+0x4d6:
80533320 817d08e2000000   cmp     dword ptr [ebp+0x8],0xe2
80533327 0f8491000000     je      nt!KeBugCheck2+0x574 (805333be)

nt!KeBugCheck2+0x4e3:
8053332d 803dc130558000   cmp  byte ptr [nt!KdDebuggerEnabled (805530c1)],0x0
80533334 0f8484000000     je      nt!KeBugCheck2+0x574 (805333be)

nt!KeBugCheck2+0x4f0:
8053333a ff3530a55580     push  dword ptr [nt!KiBugCheckData+0x10 (8055a530)]
80533340 ff352ca55580     push   dword ptr [nt!KiBugCheckData+0xc (8055a52c)]
80533346 ff3528a55580     push   dword ptr [nt!KiBugCheckData+0x8 (8055a528)]
8053334c ff3524a55580     push   dword ptr [nt!KiBugCheckData+0x4 (8055a524)]
80533352 ff3520a55580     push    dword ptr [nt!KiBugCheckData (8055a520)]
80533358 68aa385380       push    0x805338aa
8053335d e84f25fdff       call    nt!DbgPrint (805058b1)
80533362 83c418           add     esp,0x18
80533365 803dc030558000 cmp byte ptr [nt!KdDebuggerNotPresent (805530c0)],0x0
8053336c 7550             jnz     nt!KeBugCheck2+0x574 (805333be)

nt!KeBugCheck2+0x524:
8053336e 393500a55580     cmp     [nt!KiBugCheckDriver (8055a500)],esi
80533374 7410             jz      nt!KeBugCheck2+0x53c (80533386)

nt!KeBugCheck2+0x52c:
80533376 8d4598           lea     eax,[ebp-0x68]
80533379 50               push    eax
8053337a 68fa385380       push    0x805338fa
8053337f e82d25fdff       call    nt!DbgPrint (805058b1)
80533384 59               pop     ecx
80533385 59               pop     ecx

nt!KeBugCheck2+0x53c:
80533386 80bd61fcffff00   cmp     byte ptr [ebp-0x39f],0x0
8053338d 7428             jz      nt!KeBugCheck2+0x56d (805333b7)

nt!KeBugCheck2+0x545:
8053338f 39b548fcffff     cmp     [ebp-0x3b8],esi
80533395 740c             jz      nt!KeBugCheck2+0x559 (805333a3)

nt!KeBugCheck2+0x54d:
80533397 ffb548fcffff     push    dword ptr [ebp-0x3b8]
8053339d e80f25fdff       call    nt!DbgPrint (805058b1)
805333a2 59               pop     ecx

nt!KeBugCheck2+0x559:
805333a3 39b54cfcffff     cmp     [ebp-0x3b4],esi
805333a9 740c             jz      nt!KeBugCheck2+0x56d (805333b7)

nt!KeBugCheck2+0x561:
805333ab ffb54cfcffff     push    dword ptr [ebp-0x3b4]
805333b1 e8fb24fdff       call    nt!DbgPrint (805058b1)
805333b6 59               pop     ecx

nt!KeBugCheck2+0x56d:
805333b7 6a03             push    0x3
805333b9 e810f5ffff       call    nt!KiBugCheckDebugBreak (805328ce)

nt!KeBugCheck2+0x574:
805333be e88c18feff       call    nt!KeDisableInterrupts (80514c4f)
805333c3 b11f             mov     cl,0x1f
805333c5 ff1548764d80     call    dword ptr [nt!_imp_KfRaiseIrql (804d7648)]
805333cb b8ffffffff       mov     eax,0xffffffff
805333d0 b97c0c5580       mov     ecx,0x80550c7c
805333d5 0fc101           xadd    [ecx],eax
805333d8 48               dec     eax
805333d9 0f8596040000     jne     nt!KeBugCheck2+0xa2b (80533875)

nt!KeBugCheck2+0x595:
805333df a120a55580       mov     eax,[nt!KiBugCheckData (8055a520)]
805333e4 56               push    esi
805333e5 56               push    esi
805333e6 56               push    esi
805333e7 56               push    esi
805333e8 6a0e             push    0xe
805333ea 89855cfcffff     mov     [ebp-0x3a4],eax
805333f0 c68562fcffff01   mov     byte ptr [ebp-0x39e],0x1
805333f7 e894c9fdff       call    nt!HeadlessDispatch (8050fd90)
805333fc 56               push    esi
805333fd 56               push    esi
805333fe 6a01             push    0x1
80533400 8d8562fcffff     lea     eax,[ebp-0x39e]
80533406 50               push    eax
80533407 6a01             push    0x1
80533409 e882c9fdff       call    nt!HeadlessDispatch (8050fd90)
8053340e 56               push    esi
8053340f 56               push    esi
80533410 6a04             push    0x4
80533412 8d855cfcffff     lea     eax,[ebp-0x3a4]
80533418 50               push    eax
80533419 6a14             push    0x14
8053341b e870c9fdff       call    nt!HeadlessDispatch (8050fd90)
80533420 e8d69fffff       call    nt!InbvIsBootDriverInstalled (8052d3fb)
80533425 84c0             test    al,al
80533427 743f             jz      nt!KeBugCheck2+0x61e (80533468)

nt!KeBugCheck2+0x5df:
80533429 e8ada1ffff       call    nt!InbvAcquireDisplayOwnership (8052d5db)
8053342e e8da9fffff       call    nt!InbvResetDisplay (8052d40d)
80533433 6a04             push    0x4
80533435 68df010000       push    0x1df
8053343a bb7f020000       mov     ebx,0x27f
8053343f 53               push    ebx
80533440 56               push    esi
80533441 56               push    esi
80533442 e84aa0ffff       call    nt!InbvSolidColorFill (8052d491)
80533447 6a0f             push    0xf
80533449 e8d1a0ffff       call    nt!InbvSetTextColor (8052d51f)
8053344e 56               push    esi
8053344f e84a12feff       call   nt!InbvInstallDisplayStringFilter (8051469e)
80533454 6a01             push    0x1
80533456 e84ec7fdff       call    nt!InbvEnableDisplayString (8050fba9)
8053345b 68db010000       push    0x1db
80533460 53               push    ebx
80533461 56               push    esi
80533462 56               push    esi
80533463 e8d3a1ffff       call    nt!InbvSetScrollRegion (8052d63b)

nt!KeBugCheck2+0x61e:
80533468 80bd61fcffff00   cmp     byte ptr [ebp-0x39f],0x0
8053346f 0f852c010000     jne     nt!KeBugCheck2+0x757 (805335a1)

nt!KeBugCheck2+0x62b:
80533475 6812395380       push    0x80533912
8053347a e869c9fdff       call    nt!InbvDisplayString (8050fde8)
8053347f 56               push    esi
80533480 687f000040       push    0x4000007f
80533485 e853eafdff       call    nt!KeGetBugMessageText (80511edd)
8053348a 6816395380       push    0x80533916
8053348f e854c9fdff       call    nt!InbvDisplayString (8050fde8)
80533494 393500a55580     cmp     [nt!KiBugCheckDriver (8055a500)],esi
8053349a 743f             jz      nt!KeBugCheck2+0x691 (805334db)

nt!KeBugCheck2+0x652:
8053349c 56               push    esi
8053349d 6880000040       push    0x40000080
805334a2 e836eafdff       call    nt!KeGetBugMessageText (80511edd)
805334a7 6a67             push    0x67
805334a9 8d8530ffffff     lea     eax,[ebp-0xd0]
805334af 50               push    eax
805334b0 ff3500a55580     push    dword ptr [nt!KiBugCheckDriver (8055a500)]
805334b6 e8d4f3ffff       call    nt!KeBugCheckUnicodeToAnsi (8053288f)
805334bb 681a395380       push    0x8053391a
805334c0 e823c9fdff       call    nt!InbvDisplayString (8050fde8)
805334c5 8d8530ffffff     lea     eax,[ebp-0xd0]
805334cb 50               push    eax
805334cc e817c9fdff       call    nt!InbvDisplayString (8050fde8)
805334d1 681e395380       push    0x8053391e
805334d6 e80dc9fdff       call    nt!InbvDisplayString (8050fde8)

nt!KeBugCheck2+0x691:
805334db 81bd50fcffff82000040 cmp dword ptr [ebp-0x3b0],0x40000082
805334e5 7516             jnz     nt!KeBugCheck2+0x6b3 (805334fd)

nt!KeBugCheck2+0x69d:
805334e7 56               push    esi
805334e8 ff3520a55580     push    dword ptr [nt!KiBugCheckData (8055a520)]
805334ee e8eae9fdff       call    nt!KeGetBugMessageText (80511edd)
805334f3 6822395380       push    0x80533922
805334f8 e8ebc8fdff       call    nt!InbvDisplayString (8050fde8)

nt!KeBugCheck2+0x6b3:
805334fd 56               push    esi
805334fe 6881000040       push    0x40000081
80533503 e8d5e9fdff       call    nt!KeGetBugMessageText (80511edd)
80533508 6826395380       push    0x80533926
8053350d e8d6c8fdff       call    nt!InbvDisplayString (8050fde8)
80533512 56               push    esi
80533513 ffb550fcffff     push    dword ptr [ebp-0x3b0]
80533519 e8bfe9fdff       call    nt!KeGetBugMessageText (80511edd)
8053351e 682a395380       push    0x8053392a
80533523 e8c0c8fdff       call    nt!InbvDisplayString (8050fde8)
80533528 56               push    esi
80533529 6883000040       push    0x40000083
8053352e e8aae9fdff       call    nt!KeGetBugMessageText (80511edd)
80533533 ff3530a55580     push  dword ptr [nt!KiBugCheckData+0x10 (8055a530)]
80533539 8d8530ffffff     lea     eax,[ebp-0xd0]
8053353f ff352ca55580     push   dword ptr [nt!KiBugCheckData+0xc (8055a52c)]
80533545 ff3528a55580     push   dword ptr [nt!KiBugCheckData+0x8 (8055a528)]
8053354b ff3524a55580     push   dword ptr [nt!KiBugCheckData+0x4 (8055a524)]
80533551 ff3520a55580     push    dword ptr [nt!KiBugCheckData (8055a520)]
80533557 682e395380       push    0x8053392e
8053355c 50               push    eax
8053355d e8cb80fdff       call    nt!sprintf (8050b62d)
80533562 83c41c           add     esp,0x1c
80533565 8d8530ffffff     lea     eax,[ebp-0xd0]
8053356b 50               push    eax
8053356c e877c8fdff       call    nt!InbvDisplayString (8050fde8)
80533571 393500a55580     cmp     [nt!KiBugCheckDriver (8055a500)],esi
80533577 7411             jz      nt!KeBugCheck2+0x740 (8053358a)

nt!KeBugCheck2+0x72f:
80533579 8d4598           lea     eax,[ebp-0x68]
8053357c 50               push    eax
8053357d e866c8fdff       call    nt!InbvDisplayString (8050fde8)
80533582 393500a55580     cmp     [nt!KiBugCheckDriver (8055a500)],esi
80533588 753d             jnz     nt!KeBugCheck2+0x77d (805335c7)

nt!KeBugCheck2+0x740:
8053358a 688f285380       push    0x8053288f
8053358f 6a04             push    0x4
80533591 6824a55580       push    0x8055a524
80533596 8d4598           lea     eax,[ebp-0x68]
80533599 50               push    eax
8053359a e88af4ffff       call    nt!KiDumpParameterImages (80532a29)
8053359f eb26             jmp     nt!KeBugCheck2+0x77d (805335c7)

nt!KeBugCheck2+0x757:
805335a1 39b548fcffff     cmp     [ebp-0x3b8],esi
805335a7 740b             jz      nt!KeBugCheck2+0x76a (805335b4)

nt!KeBugCheck2+0x75f:
805335a9 ffb548fcffff     push    dword ptr [ebp-0x3b8]
805335af e834c8fdff       call    nt!InbvDisplayString (8050fde8)

nt!KeBugCheck2+0x76a:
805335b4 39b54cfcffff     cmp     [ebp-0x3b4],esi
805335ba 740b             jz      nt!KeBugCheck2+0x77d (805335c7)

nt!KeBugCheck2+0x772:
805335bc ffb54cfcffff     push    dword ptr [ebp-0x3b4]
805335c2 e821c8fdff       call    nt!InbvDisplayString (8050fde8)

nt!KeBugCheck2+0x77d:
805335c7 e88bf7ffff       call   nt!KiInvokeBugCheckEntryCallbacks (80532d57)
805335cc 803dc130558000   cmp  byte ptr [nt!KdDebuggerEnabled (805530c1)],0x0
805335d3 7512             jnz     nt!KeBugCheck2+0x79d (805335e7)

nt!KeBugCheck2+0x78b:
805335d5 803d7ccb548000   cmp    byte ptr [nt!KdPitchDebugger (8054cb7c)],0x0
805335dc 7509             jnz     nt!KeBugCheck2+0x79d (805335e7)

nt!KeBugCheck2+0x794:
805335de 56               push    esi
805335df 56               push    esi
805335e0 e8a3761400       call    nt!KdInitSystem (8067ac88)
805335e5 eb0a             jmp     nt!KeBugCheck2+0x7a7 (805335f1)

nt!KeBugCheck2+0x79d:
805335e7 685a395380       push    0x8053395a
805335ec e8f7c7fdff       call    nt!InbvDisplayString (8050fde8)

nt!KeBugCheck2+0x7a7:
805335f1 3ea120f0dfff     mov     eax,ds:[ffdff020]
805335f7 bbb3000000       mov     ebx,0xb3
805335fc 8d781c           lea     edi,[eax+0x1c]
805335ff 8bcb             mov     ecx,ebx
80533601 8db564fcffff     lea     esi,[ebp-0x39c]
80533607 f3a5             rep     movsd
80533609 e88eb4ffff       call    nt!IoIsTriageDumpEnabled (8052ea9c)
8053360e 84c0             test    al,al
80533610 0f8426020000     je      nt!KeBugCheck2+0x9f2 (8053383c)

nt!KeBugCheck2+0x7cc:
80533616 83bd58fcffff00   cmp     dword ptr [ebp-0x3a8],0x0
8053361d 7423             jz      nt!KeBugCheck2+0x7f8 (80533642)

nt!KeBugCheck2+0x7d5:
8053361f 8d8564fcffff     lea     eax,[ebp-0x39c]
80533625 50               push    eax
80533626 6a00             push    0x0
80533628 ffb558fcffff     push    dword ptr [ebp-0x3a8]
8053362e c78564fcffff07000100 mov dword ptr [ebp-0x39c],0x10007
80533638 e8d22efbff       call    nt!KeContextFromKframes (804e650f)
8053363d e94c010000       jmp     nt!KeBugCheck2+0x944 (8053378e)

nt!KeBugCheck2+0x7f8:
80533642 8b4508           mov     eax,[ebp+0x8]
80533645 83e87e           sub     eax,0x7e
80533648 0f842c010000     je      nt!KeBugCheck2+0x930 (8053377a)

nt!KeBugCheck2+0x804:
8053364e 48               dec     eax
8053364f 7453             jz      nt!KeBugCheck2+0x85a (805336a4)

nt!KeBugCheck2+0x807:
80533651 83e86b           sub     eax,0x6b
80533654 0f853b010000     jne     nt!KeBugCheck2+0x94b (80533795)

nt!KeBugCheck2+0x810:
8053365a 8b8544fcffff     mov     eax,[ebp-0x3bc]
80533660 80782d02         cmp     byte ptr [eax+0x2d],0x2
80533664 898540fcffff     mov     [ebp-0x3c0],eax
8053366a 7516             jnz     nt!KeBugCheck2+0x838 (80533682)

nt!KeBugCheck2+0x822:
8053366c 0fb6802b010000   movzx   eax,byte ptr [eax+0x12b]
80533673 8b3485209a5580   mov     esi,[nt!KiProcessorBlock (80559a20)+eax*4]
8053367a 83c61c           add     esi,0x1c
8053367d e902010000       jmp     nt!KeBugCheck2+0x93a (80533784)

nt!KeBugCheck2+0x838:
80533682 8b4028           mov     eax,[eax+0x28]
80533685 8d480c           lea     ecx,[eax+0xc]
80533688 898d28fdffff     mov     [ebp-0x2d8],ecx
8053368e 8b09             mov     ecx,[ecx]
80533690 898d18fdffff     mov     [ebp-0x2e8],ecx
80533696 8b4008           mov     eax,[eax+0x8]
80533699 89851cfdffff     mov     [ebp-0x2e4],eax
8053369f e9ea000000       jmp     nt!KeBugCheck2+0x944 (8053378e)

nt!KeBugCheck2+0x85a:
805336a4 83bd44fcffff08   cmp     dword ptr [ebp-0x3bc],0x8
805336ab 0f85e4000000     jne     nt!KeBugCheck2+0x94b (80533795)

nt!KeBugCheck2+0x867:
805336b1 8b8538fcffff     mov     eax,[ebp-0x3c8]
805336b7 85c0             test    eax,eax
805336b9 0f84cf000000     je      nt!KeBugCheck2+0x944 (8053378e)

nt!KeBugCheck2+0x875:
805336bf 8b4824           mov     ecx,[eax+0x24]
805336c2 f7c100000200     test    ecx,0x20000
805336c8 740c             jz      nt!KeBugCheck2+0x88c (805336d6)

nt!KeBugCheck2+0x880:
805336ca 0fb75050         movzx   edx,word ptr [eax+0x50]

nt!KeBugCheck2+0x884:
805336ce 89952cfdffff     mov     [ebp-0x2d4],edx
805336d4 eb19             jmp     nt!KeBugCheck2+0x8a5 (805336ef)

nt!KeBugCheck2+0x88c:
805336d6 f6404c01         test    byte ptr [eax+0x4c],0x1
805336da 7409             jz      nt!KeBugCheck2+0x89b (805336e5)

nt!KeBugCheck2+0x892:
805336dc 0fb75050         movzx   edx,word ptr [eax+0x50]
805336e0 83ca03           or      edx,0x3
805336e3 ebe9             jmp     nt!KeBugCheck2+0x884 (805336ce)

nt!KeBugCheck2+0x89b:
805336e5 c7852cfdffff10000000 mov dword ptr [ebp-0x2d4],0x10

nt!KeBugCheck2+0x8a5:
805336ef 0fb7505c         movzx   edx,word ptr [eax+0x5c]
805336f3 8995f0fcffff     mov     [ebp-0x310],edx
805336f9 0fb75058         movzx   edx,word ptr [eax+0x58]
805336fd 8995f4fcffff     mov     [ebp-0x30c],edx
80533703 0fb75048         movzx   edx,word ptr [eax+0x48]
80533707 8995f8fcffff     mov     [ebp-0x308],edx
8053370d 0fb75054         movzx   edx,word ptr [eax+0x54]
80533711 8995fcfcffff     mov     [ebp-0x304],edx
80533717 0fb7504c         movzx   edx,word ptr [eax+0x4c]
8053371b 899520fdffff     mov     [ebp-0x2e0],edx
80533721 8b5038           mov     edx,[eax+0x38]
80533724 899528fdffff     mov     [ebp-0x2d8],edx
8053372a 8b5020           mov     edx,[eax+0x20]
8053372d 89951cfdffff     mov     [ebp-0x2e4],edx
80533733 8b503c           mov     edx,[eax+0x3c]
80533736 899518fdffff     mov     [ebp-0x2e8],edx
8053373c 8b5028           mov     edx,[eax+0x28]
8053373f 899514fdffff     mov     [ebp-0x2ec],edx
80533745 8b5034           mov     edx,[eax+0x34]
80533748 899508fdffff     mov     [ebp-0x2f8],edx
8053374e 8b502c           mov     edx,[eax+0x2c]
80533751 899510fdffff     mov     [ebp-0x2f0],edx
80533757 8b5030           mov     edx,[eax+0x30]
8053375a 89950cfdffff     mov     [ebp-0x2f4],edx
80533760 8b5044           mov     edx,[eax+0x44]
80533763 8b4040           mov     eax,[eax+0x40]
80533766 899500fdffff     mov     [ebp-0x300],edx
8053376c 898504fdffff     mov     [ebp-0x2fc],eax
80533772 898d24fdffff     mov     [ebp-0x2dc],ecx
80533778 eb14             jmp     nt!KeBugCheck2+0x944 (8053378e)

nt!KeBugCheck2+0x930:
8053377a 8bb53cfcffff     mov     esi,[ebp-0x3c4]
80533780 85f6             test    esi,esi
80533782 7411             jz      nt!KeBugCheck2+0x94b (80533795)

nt!KeBugCheck2+0x93a:
80533784 8dbd64fcffff     lea     edi,[ebp-0x39c]
8053378a 8bcb             mov     ecx,ebx
8053378c f3a5             rep     movsd

nt!KeBugCheck2+0x944:
8053378e 800d23a5558010   or byte ptr [nt!KiBugCheckData+0x3 (8055a523)],0x10

nt!KeBugCheck2+0x94b:
80533795 a124a55580       mov     eax,[nt!KiBugCheckData+0x4 (8055a524)]
8053379a bf00100000       mov     edi,0x1000
8053379f be00f0ffff       mov     esi,0xfffff000
805337a4 57               push    edi
805337a5 23c6             and     eax,esi
805337a7 50               push    eax
805337a8 e806b2ffff       call    nt!IoAddTriageDumpDataBlock (8052e9b3)
805337ad a128a55580       mov     eax,[nt!KiBugCheckData+0x8 (8055a528)]
805337b2 57               push    edi
805337b3 23c6             and     eax,esi
805337b5 50               push    eax
805337b6 e8f8b1ffff       call    nt!IoAddTriageDumpDataBlock (8052e9b3)
805337bb a12ca55580       mov     eax,[nt!KiBugCheckData+0xc (8055a52c)]
805337c0 57               push    edi
805337c1 23c6             and     eax,esi
805337c3 50               push    eax
805337c4 e8eab1ffff       call    nt!IoAddTriageDumpDataBlock (8052e9b3)
805337c9 a130a55580       mov     eax,[nt!KiBugCheckData+0x10 (8055a530)]
805337ce 57               push    edi
805337cf 23c6             and     eax,esi
805337d1 50               push    eax
805337d2 e8dcb1ffff       call    nt!IoAddTriageDumpDataBlock (8052e9b3)
805337d7 a120a55580       mov     eax,[nt!KiBugCheckData (8055a520)]
805337dc 25ffffffef       and     eax,0xefffffff
805337e1 3dcd000000       cmp     eax,0xcd
805337e6 741d             jz      nt!KeBugCheck2+0x9bb (80533805)

nt!KeBugCheck2+0x99e:
805337e8 3dd6000000       cmp     eax,0xd6
805337ed 7416             jz      nt!KeBugCheck2+0x9bb (80533805)

nt!KeBugCheck2+0x9a5:
805337ef 3dd1000000       cmp     eax,0xd1
805337f4 7522             jnz     nt!KeBugCheck2+0x9ce (80533818)

nt!KeBugCheck2+0x9ac:
805337f6 ff3524a55580     push   dword ptr [nt!KiBugCheckData+0x4 (8055a524)]
805337fc e87a6b0000       call    nt!MmIsSpecialPoolAddress (8053a37b)
80533801 85c0             test    eax,eax
80533803 7413             jz      nt!KeBugCheck2+0x9ce (80533818)

nt!KeBugCheck2+0x9bb:
80533805 a124a55580       mov     eax,[nt!KiBugCheckData+0x4 (8055a524)]
8053380a 0500f0ffff       add     eax,0xfffff000
8053380f 23c6             and     eax,esi
80533811 57               push    edi
80533812 50               push    eax
80533813 e89bb1ffff       call    nt!IoAddTriageDumpDataBlock (8052e9b3)

nt!KeBugCheck2+0x9ce:
80533818 3ea120f0dfff     mov     eax,ds:[ffdff020]
8053381e 83b87408000000   cmp     dword ptr [eax+0x874],0x0
80533825 7415             jz      nt!KeBugCheck2+0x9f2 (8053383c)

nt!KeBugCheck2+0x9dd:
80533827 3ea120f0dfff     mov     eax,ds:[ffdff020]
8053382d 8b8074080000     mov     eax,[eax+0x874]
80533833 57               push    edi
80533834 23c6             and     eax,esi
80533836 50               push    eax
80533837 e877b1ffff       call    nt!IoAddTriageDumpDataBlock (8052e9b3)

nt!KeBugCheck2+0x9f2:
8053383c 8d8563fcffff     lea     eax,[ebp-0x39d]
80533842 50               push    eax
80533843 ffb540fcffff     push    dword ptr [ebp-0x3c0]
80533849 8d8564fcffff     lea     eax,[ebp-0x39c]
8053384f 50               push    eax
80533850 ff3530a55580     push  dword ptr [nt!KiBugCheckData+0x10 (8055a530)]
80533856 ff352ca55580     push   dword ptr [nt!KiBugCheckData+0xc (8055a52c)]
8053385c ff3528a55580     push   dword ptr [nt!KiBugCheckData+0x8 (8055a528)]
80533862 ff3524a55580     push   dword ptr [nt!KiBugCheckData+0x4 (8055a524)]
80533868 ff3520a55580     push    dword ptr [nt!KiBugCheckData (8055a520)]
8053386e e813cbffff       call    nt!IoWriteCrashDump (80530386)
80533873 33f6             xor     esi,esi
80533875 e8b1f3ffff       call    nt!KiScanBugCheckCallbackList (80532c2b)

nt!KeBugCheck2+0xa2b:
80533875 e8b1f3ffff       call    nt!KiScanBugCheckCallbackList (80532c2b)

nt!KeBugCheck2+0xa30:
8053387a 80bd63fcffff00   cmp     byte ptr [ebp-0x39d],0x0
80533881 7411             jz      nt!KeBugCheck2+0xa4a (80533894)

nt!KeBugCheck2+0xa39:
80533883 56               push    esi
80533884 6aff             push    0xff
80533886 56               push    esi
80533887 e83cb8fdff       call    nt!DbgUnLoadImageSymbols (8050f0c8)
8053388c 6a03             push    0x3
8053388e ff15ac754d80 call dword ptr [nt!_imp__HalReturnToFirmware (804d75ac)]

nt!KeBugCheck2+0xa4a:
80533894 6a04             push    0x4
80533896 e833f0ffff       call    nt!KiBugCheckDebugBreak (805328ce)
8053389b 8b4dfc           mov     ecx,[ebp-0x4]
8053389e 5f               pop     edi
8053389f 5e               pop     esi
805338a0 5b               pop     ebx
805338a1 e84b10fbff       call    nt!xKdCheckPowerButton (804e48f1)
805338a6 c9               leave
805338a7 c21800           ret     0x18

posted on 2006年3月13日 10:38 由 Raymond

# re: KeBugCheck2的第6个参数 @ 2009年6月5日 0:19

啊?这就完了?
参数是什么啊?汇编代码自己可以IDA啊。。。

我来科普一下,这个参数实际是: PKTRAP_FRAME TrapFrame

- Kernel trap frame associated with the system failure (can be NULL).

MJ0011

Powered by Community Server Powered by CnForums.Net