Re: 初来寻BSOD问题帮助

Windows内核调试

初来寻BSOD问题帮助

雅歌 2013-06-19, 17:00 下午
我一个应用程序eventlogmonito，在用户的虚拟机里运行蓝屏了。要用户给了dump文件。我用windbg打开看了下，的确是我的应用程序导致，但原因真不明，请大牛帮忙分析一下，不胜感谢！附上windbg分析结果和dump文件
kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 00000005016049f8, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000001, value 0 = read operation, 1 = write operation
Arg4: fffff8800160123a, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff800016c0100
 00000005016049f8 

CURRENT_IRQL:  2

FAULTING_IP: 
mup!MupReleaseIrpContext+112
fffff880`0160123a 49895008        mov     qword ptr [r8+8],rdx

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  DRIVER_FAULT_SERVER_MINIDUMP

BUGCHECK_STR:  0xD1

PROCESS_NAME:  eventlogmonito

TRAP_FRAME:  fffff8800397be20 -- (.trap 0xfffff8800397be20)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=fffff88001604a00
rdx=fffffa8090b8fee8 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8800160123a rsp=fffff8800397bfb0 rbp=fffffa800b14f5b8
 r8=00000005016049f0  r9=0000000000000000 r10=fffffa8003cd9e80
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na po nc
mup!MupReleaseIrpContext+0x112:
fffff880`0160123a 49895008        mov     qword ptr [r8+8],rdx ds:020c:00000005`016049f8=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff800014881a9 to fffff80001488c00

STACK_TEXT:  
fffff880`0397bcd8 fffff800`014881a9 : 00000000`0000000a 00000005`016049f8 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
fffff880`0397bce0 fffff800`01486e20 : fffffa80`c1751350 fffffa80`06d34010 00000000`00000000 fffffa80`0b14f570 : nt!KiBugCheckDispatch+0x69
fffff880`0397be20 fffff880`0160123a : fffffa80`0b14f5b8 00000000`00000001 fffffa80`0687f8a0 fffffa80`0b14f570 : nt!KiPageFault+0x260
fffff880`0397bfb0 fffff880`01606243 : fffffa80`0b14f570 00000000`00000001 00000000`00000000 fffffa80`0687f8a0 : mup!MupReleaseIrpContext+0x112
fffff880`0397bfe0 fffff880`01601a60 : fffffa80`06d34010 00000000`00000000 fffffa80`03ff6a30 fffffa80`0b14f570 : mup!MupStateMachine+0x233
fffff880`0397c030 fffff800`0148c5c1 : fffffa80`06d34173 fffffa80`06ef5b30 fffffa80`09880170 fffffa80`09880158 : mup!MupiUncProviderCompletion+0x94
fffff880`0397c070 fffff880`0244eb81 : 00000000`00000000 fffffa80`a1c19c01 fffffa80`06d34010 00000000`00000000 : nt!IopfCompleteRequest+0x341
fffff880`0397c160 fffff880`0244f8f1 : fffffa80`c14d59c0 fffff8a0`065ba301 00000000`00000000 fffffa80`c14d59c0 : rdbss!RxCompleteRequestEx+0x301
fffff880`0397c240 fffff880`024535d2 : fffffa80`c14d59c0 fffffa80`09880140 fffffa80`c14d59c0 00000000`00000000 : rdbss!RxLowIoCompletionTail+0x125
fffff880`0397c280 fffff880`0373b92e : fffffa80`c14d59c0 fffffa80`09880140 00000000`00000000 00000000`00000000 : rdbss!RxLowIoCompletion+0x82
fffff880`0397c2c0 fffff880`037601fa : 00000000`000010b8 fffff8a0`065ba3b0 00000000`00000000 00000000`000007ff : mrxsmb10!MRxSmbNamedPipeFsControlCompletion+0xbe
fffff880`0397c300 fffff880`0375f6a1 : fffffa80`c14d59c0 fffff800`00000000 fffff880`0397c400 fffff8a0`06cef401 : mrxsmb10!MRxSmbNamedPipeFsControl+0x7f2
fffff880`0397c480 fffff880`0372d592 : 00000000`00000000 fffffa80`06d34170 fffff880`03729200 00000000`00000000 : mrxsmb10!MRxSmbFsCtl+0x221
fffff880`0397c4c0 fffff880`02472b99 : 00000000`00000006 00000000`00000000 00000000`00000000 ffffffff`00000000 : mrxsmb!MRxSmbFsCtl+0x92
fffff880`0397c4f0 fffff880`02478025 : 00000000`00000000 fffffa80`06d34170 fffffa80`c14d59c0 fffff880`0244e697 : rdbss!RxLowIoSubmit+0x291
fffff880`0397c550 fffff880`02477c15 : fffff8a0`065ba3b0 fffff880`0397c750 00000000`00000000 fffff880`0397c750 : rdbss!RxLowIoFsCtlShell+0x1c5
fffff880`0397c5c0 fffff880`02450684 : fffffa80`c1751350 fffff880`0397c750 00000000`00000000 fffffa80`c14d59c0 : rdbss!RxCommonFileSystemControl+0xe45
fffff880`0397c710 fffff880`0246db44 : fffffa80`06d34010 fffffa80`0432100d 00000000`0397c990 fffff880`0397c810 : rdbss!RxFsdCommonDispatch+0x870
fffff880`0397c800 fffff880`0372c2cc : fffffa80`06d34010 fffff880`0397c990 fffffa80`06d34170 fffffa80`04321040 : rdbss!RxFsdDispatch+0x224
fffff880`0397c870 fffff880`01608271 : fffffa80`0b14f570 fffffa80`06d34010 fffffa80`0687f8a0 fffff8a0`001f5b20 : mrxsmb!MRxSmbFsdDispatch+0xc0
fffff880`0397c8b0 fffff880`01606138 : fffff8a0`001f5b20 fffffa80`0b14f570 00000000`00000001 00000000`00000000 : mup!MupiCallUncProvider+0x161
fffff880`0397c920 fffff880`016079e3 : fffffa80`06d34010 fffff880`0397cca0 fffffa80`c1751350 00000000`00000000 : mup!MupStateMachine+0x128
fffff880`0397c970 fffff880`0122291e : fffffa80`03ff7c20 fffffa80`0b14f570 00000000`00000000 00000000`00000000 : mup!MupFsControl+0x7f
fffff880`0397c9b0 fffff800`017a6f37 : fffffa80`c1751350 fffff880`0397cca0 fffffa80`06d34200 fffffa80`06d34010 : fltmgr!FltpFsControl+0xae
fffff880`0397ca10 fffff800`017634f2 : fffffa80`06ef5b30 00000000`000001b9 00000000`00000001 00000000`00000000 : nt!IopXxxControlFile+0x607
fffff880`0397cb40 fffff800`01487e93 : fffffa80`06ef5b30 00000000`00000001 fffffa80`06f9eb50 fffff800`01781884 : nt!NtFsControlFile+0x56
fffff880`0397cbb0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13


STACK_COMMAND:  kb

FOLLOWUP_IP: 
mup!MupReleaseIrpContext+112
fffff880`0160123a 49895008        mov     qword ptr [r8+8],rdx

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  mup!MupReleaseIrpContext+112

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: mup

IMAGE_NAME:  mup.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bc201

FAILURE_BUCKET_ID:  X64_0xD1_mup!MupReleaseIrpContext+112

BUCKET_ID:  X64_0xD1_mup!MupReleaseIrpContext+112

Followup: MachineOwner
---------

kd> .process
Implicit process is now fffffa80`06ef5b30
kd> !process fffffa80`06ef5b30
GetPointerFromAddress: unable to read from fffff800016c0000
PROCESS fffffa8006ef5b30
    SessionId: none  Cid: 0ecc    Peb: 7efdf000  ParentCid: 01d8
    DirBase: 2d2d0000  ObjectTable: fffff8a00800d010  HandleCount: <Data Not Accessible>
    Image: eventlogmonito
    VadRoot fffffa8006aeccb0 Vads 157 Clone 0 Private 2838. Modified 0. Locked 0.
    DeviceMap fffff8a00b5b2e50
    Token                             fffff8a0130861c0
    ReadMemory error: Cannot get nt!KeMaximumIncrement value.
fffff78000000000: Unable to get shared data
    ElapsedTime                       00:00:00.000
    UserTime                          00:00:00.000
    KernelTime                        00:00:00.000
    QuotaPoolUsage[PagedPool]         0
    QuotaPoolUsage[NonPagedPool]      0
    Working Set Sizes (now,min,max)  (4222, 50, 345) (16888KB, 200KB, 1380KB)
    PeakWorkingSetSize                6844
    VirtualSize                       93 Mb
    PeakVirtualSize                   93 Mb
    PageFaultCount                    1895849
    MemoryPriority                    BACKGROUND
    BasePriority                      8
    CommitCharge                      3447

        *** Error in reading nt!_ETHREAD @ fffffa8006e9ab50
到这里我不知道如何进一步分析了，可清楚看到bsod的进程是eventlogmonito，但是到底是我的进程那行代码导致的呢？我下面应该如何走？为何会导致蓝屏？我的应用程序都是调用了应用层的api，读取windows event log进行分析，没有其他功能，所以蓝屏的出现让我百思不得其解。在真实物理机还没出现过这种问题，恳请出手相救。

Re: 初来寻BSOD问题帮助

格蠹老雷 2013-06-19, 22:12 下午

VMWare虚拟机？

蓝屏的直接原因是文件系统的MUP驱动访问被破坏了IRP（I/O请求包）而导致非法内存访问了

这样的问题大多与文件系统的过滤驱动有关系

如果你的软件没有任何驱动程序，那么这样的问题可以先考虑升级VmWare的驱动程序，或者让客户向VmWare报告......

Re: 初来寻BSOD问题帮助

雅歌 2013-06-20, 09:46 上午
非常感谢Raymond 的回复，有个问题请教，如果我要继续分析，如何定位到我的应用层代码，能分析出是哪个windows API 调用导致的吗？我是菜鸟，请指点一二。

Re: 初来寻BSOD问题帮助

格蠹老雷 2013-06-20, 23:07 下午

启动WinDBG，附加到你的进程，bp ntdll!ZwFsControlFile

然后g，执行你的程序，断点命中时，k观察，比如：

 

0:000> k
ChildEBP RetAddr 
0018d908 7630cf59 ntdll!ZwFsControlFile
0018d998 7630ce5b SHELL32!IsSMBv1+0x6a
0018dbd0 762e606b SHELL32!CEnumFiles::_InitEnumeration+0xaa
0018de00 762e5e27 SHELL32!CEnumFiles::FindSingleFile+0x5e
0018e2e0 762e5f8b SHELL32!GetFindDataForPath+0x87
0018e514 762e5eac SHELL32!CFSFolder::_FindDataFromName+0xc0
0018e7a8 762ffe55 SHELL32!CFSFolder::_CreateIDListFromName+0x3d
0018ecf4 7630c06f SHELL32!CFSFolder::ParseDisplayName+0x17a
0018ed7c 76307b33 SHELL32!CDrivesFolder::ParseDisplayName+0x153
0018ee00 76309eb3 SHELL32!CRegFolder::ParseDisplayName+0x93
0018ee40 7630817b SHELL32!CDesktopFolder::_ChildParseDisplayName+0x47
0018eebc 76307b33 SHELL32!CDesktopFolder::ParseDisplayName+0x112
0018ef40 76308054 SHELL32!CRegFolder::ParseDisplayName+0x93
0018ef8c 7642e8ae SHELL32!SHParseDisplayName+0xa8
0018f1d0 5acb428f SHELL32!SHGetFileInfoW+0x163

Re: 初来寻BSOD问题帮助

雅歌 2013-06-24, 14:01 下午
谢谢Raymond回复，你的意思是我观察我的代码里调用ZwFsControlFile的方式有哪些，然后进一步与crash 的堆栈进行对照？如果某个一致那么基本上就可以判断是这个windows API 了，我的理解对吗？

Powered by Community Server Powered by CnForums.Net