|
由于是核心内存转储，所以我看不出太多内容，请大家指点下，从下面能看出什么内容么？我应该如何继续分析，谢谢！
我自己的怀疑是应该使用了非分页内存，而这个时候这个内存却在页面文件？
另外FOLLOWUP_IP那个是什么意思啊，
tcpip!TdiSend+1cc
ba689db0 b803010000 mov eax,103h
这里完全和FAULTING_IP不搭边啊？
下面是analyze -v的结果
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - "0x%08lx"
FAULTING_IP:
nt!ExAllocatePoolWithTag+83f
8089bac3 897004 mov dword ptr [eax+4],esi
TRAP_FRAME: b4d6ba24 -- (.trap 0xffffffffb4d6ba24)
ErrCode = 00000002
eax=30306265 ebx=8a3ba090 ecx=8a3bc150 edx=00000032 esi=8a3ba258 edi=e6cff2a0
eip=8089bac3 esp=b4d6ba98 ebp=b4d6bad4 iopl=0 nv up ei pl nz ac pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010216
nt!ExAllocatePoolWithTag+0x83f:
8089bac3 897004 mov dword ptr [eax+4],esi ds:0023:30306269=????????
Resetting default scope
DEFAULT_BUCKET_ID: DRIVER_FAULT
BUGCHECK_STR: 0x8E
PROCESS_NAME: java.exe
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from 8085b4b3 to 8087b6be
STACK_TEXT:
b4d6b5f0 8085b4b3 0000008e c0000005 8089bac3 nt!KeBugCheckEx+0x1b
b4d6b9b4 808357a4 b4d6b9d0 00000000 b4d6ba24 nt!KiDispatchException+0x3a2
b4d6ba1c 80835758 b4d6bad4 8089bac3 badb0d00 nt!CommonDispatchException+0x4a
b4d6ba34 ba689db0 00000000 86ef47b0 00000080 nt!Kei386EoiHelper+0x186
b4d6bad4 80910e88 00000001 00000000 6d4e624f tcpip!TdiSend+0x1cc
b4d6baf8 80936caa 00000182 00000000 86ef47b0 nt!ObpParseSymbolicLink+0x24b
b4d6bb78 80936aa5 00000000 b4d6bbb8 00000040 nt!ObpLookupObjectName+0x5a9
b4d6bbcc 80924f0f 00000000 00000000 8083f001 nt!ObOpenObjectByName+0xea
b4d6bd54 80834d3f 2770f5b0 2770f578 2770f5e0 nt!NtQueryFullAttributesFile+0x152
b4d6bd54 7c95ed54 2770f5b0 2770f578 2770f5e0 nt!KiFastCallEntry+0xfc
WARNING: Frame IP not in any known module. Following frames may be wrong.
2770f5e0 00000000 00000000 00000000 00000000 0x7c95ed54
STACK_COMMAND: kb
FOLLOWUP_IP:
tcpip!TdiSend+1cc
ba689db0 b803010000 mov eax,103h
SYMBOL_STACK_INDEX: 4
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: tcpip
IMAGE_NAME: tcpip.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 42435dff
SYMBOL_NAME: tcpip!TdiSend+1cc
FAILURE_BUCKET_ID: 0x8E_tcpip!TdiSend+1cc
BUCKET_ID: 0x8E_tcpip!TdiSend+1cc
Followup: MachineOwner
---------
|