请教一个tcpid.sys导致windows bsod的问题

Windows内核调试

请教一个tcpid.sys导致windows bsod的问题

---

jlflyfox 2010-01-06, 21:40 下午

由于是核心内存转储，所以我看不出太多内容，请大家指点下，从下面能看出什么内容么？我应该如何继续分析，谢谢！

我自己的怀疑是应该使用了非分页内存，而这个时候这个内存却在页面文件？

另外FOLLOWUP_IP那个是什么意思啊，

tcpip!TdiSend+1cc
ba689db0 b803010000      mov     eax,103h

这里完全和FAULTING_IP不搭边啊？

下面是analyze -v的结果

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - "0x%08lx"

FAULTING_IP:
nt!ExAllocatePoolWithTag+83f
8089bac3 897004          mov     dword ptr [eax+4],esi

TRAP_FRAME:  b4d6ba24 -- (.trap 0xffffffffb4d6ba24)
ErrCode = 00000002
eax=30306265 ebx=8a3ba090 ecx=8a3bc150 edx=00000032 esi=8a3ba258 edi=e6cff2a0
eip=8089bac3 esp=b4d6ba98 ebp=b4d6bad4 iopl=0         nv up ei pl nz ac pe nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010216
nt!ExAllocatePoolWithTag+0x83f:
8089bac3 897004          mov     dword ptr [eax+4],esi ds:0023:30306269=????????
Resetting default scope

DEFAULT_BUCKET_ID:  DRIVER_FAULT

BUGCHECK_STR:  0x8E

PROCESS_NAME:  java.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from 8085b4b3 to 8087b6be

STACK_TEXT: 
b4d6b5f0 8085b4b3 0000008e c0000005 8089bac3 nt!KeBugCheckEx+0x1b
b4d6b9b4 808357a4 b4d6b9d0 00000000 b4d6ba24 nt!KiDispatchException+0x3a2
b4d6ba1c 80835758 b4d6bad4 8089bac3 badb0d00 nt!CommonDispatchException+0x4a
b4d6ba34 ba689db0 00000000 86ef47b0 00000080 nt!Kei386EoiHelper+0x186
b4d6bad4 80910e88 00000001 00000000 6d4e624f tcpip!TdiSend+0x1cc
b4d6baf8 80936caa 00000182 00000000 86ef47b0 nt!ObpParseSymbolicLink+0x24b
b4d6bb78 80936aa5 00000000 b4d6bbb8 00000040 nt!ObpLookupObjectName+0x5a9
b4d6bbcc 80924f0f 00000000 00000000 8083f001 nt!ObOpenObjectByName+0xea
b4d6bd54 80834d3f 2770f5b0 2770f578 2770f5e0 nt!NtQueryFullAttributesFile+0x152
b4d6bd54 7c95ed54 2770f5b0 2770f578 2770f5e0 nt!KiFastCallEntry+0xfc
WARNING: Frame IP not in any known module. Following frames may be wrong.
2770f5e0 00000000 00000000 00000000 00000000 0x7c95ed54

STACK_COMMAND:  kb

FOLLOWUP_IP:
tcpip!TdiSend+1cc
ba689db0 b803010000      mov     eax,103h

SYMBOL_STACK_INDEX:  4

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: tcpip

IMAGE_NAME:  tcpip.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  42435dff

SYMBOL_NAME:  tcpip!TdiSend+1cc

FAILURE_BUCKET_ID:  0x8E_tcpip!TdiSend+1cc

BUCKET_ID:  0x8E_tcpip!TdiSend+1cc

Followup: MachineOwner
---------