Advanced Debugging
About AdvDbg Consult Train Services Products Tools Community Contact  
欢迎光临 高端调试 登录 | 注册 | FAQ
 
  ACPI调试
Linux内核调试
Windows内核调试
 
  调试战役
调试原理
新工具观察
 
  Linux
Windows Vista
Windows
 
  Linux驱动
WDF
WDM
 
  PCI Express
PCI/PCI-X
USB
无线通信协议
 
  64位CPU
ARM
IA-32
  CPU Info Center
 
  ACPI标准
系统认证
Desktop
服务器
 
  Embedded Linux
嵌入式开发工具
VxWorks
WinCE
嵌入式Windows
 
  格蠹调试套件(GDK)
  格蠹学院
  小朱书店
  老雷的微博
  《软件调试》
  《格蠹汇编》
  《软件调试(第二版)》
沪ICP备11027180号-1

转储分析

帖子发起人: zhaohui2   发起时间: 2015-01-07 22:58 下午   回复: 2

Print Search
帖子排序:    
   2015-01-07, 22:58 下午
SkyDown 离线,最后访问时间: 2017/5/20 7:47:23 zhaohui2

发帖数前50位
注册: 2013-06-19
发 贴: 19
分析dump文件时,栈回溯看不明白
Reply Quote
今天分析一个蓝屏的dump文件时,栈回溯看不明白.
栈回溯内容如下
0: kd> kv
Child-SP          RetAddr           : Args to Child                                                           : Call Site
ffffd000`219207f8 fffff802`05a05f65 : 00000000`0000004c 00000000`c000021a ffffd000`633dd538 ffffe000`15621ed0 : nt!KeBugCheckEx
ffffd000`21920800 fffff802`05a0003a : ffffe000`13c59900 ffffd000`21920919 00000000`00000000 00000000`00000002 : nt!PopGracefulShutdown+0x2c9
ffffd000`21920840 fffff802`057d69b3 : ffffe000`13c59600 fffff802`057b3800 00000000`c0000004 fffff802`056f0200 : nt! ?? ::OKHAJAOM::`string'+0x207a
ffffd000`21920980 fffff802`057cee00 : fffff802`05c1f8e9 00000000`00000001 ffffd000`21920b98 00000000`c0000004 : nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ ffffd000`21920980)
ffffd000`21920b18 fffff802`05c1f8e9 : 00000000`00000001 ffffd000`21920b98 00000000`c0000004 ffffd000`66eca180 : nt!KiServiceLinkage
ffffd000`21920b20 fffff802`05b52727 : 00000000`00000000 00000000`00000000 ffffd000`66eca180 ffffe000`13c59740 : nt! ?? ::NNGAKEGL::`string'+0x74b99
ffffd000`21920be0 fffff802`0575004a : fffff802`0574ff90 00000000`00000000 00000000`00000002 ffffe000`13c59600 : nt!PopPolicyWorkerAction+0x63
ffffd000`21920c50 fffff802`056eb5e3 : fffff802`00000002 ffffd000`21920d10 00000000`80000000 00000000`00000000 : nt!PopPolicyWorkerThread+0xba
ffffd000`21920c90 fffff802`0577ae70 : ffffe000`10938320 ffffe000`13c59600 ffffe000`13c59600 ffffe000`0ff2d640 : nt!ExpWorkerThread+0x293
ffffd000`21920d40 fffff802`057d17c6 : ffffd000`66eca180 ffffe000`13c59600 ffffe000`1b651040 00000000`00000000 : nt!PspSystemThreadStartup+0x58
ffffd000`21920da0 00000000`00000000 : ffffd000`21921000 ffffd000`2191b000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x16

张老师,我想问一下,
nt! ?? ::NNGAKEGL::`string'+0x74b99和nt! ?? ::OKHAJAOM::`string'+0x207a是什么.


IP 地址: 已记录   报告
   2015-01-07, 22:59 下午
SkyDown 离线,最后访问时间: 2017/5/20 7:47:23 zhaohui2

发帖数前50位
注册: 2013-06-19
发 贴: 19
Re: 分析dump文件时,栈回溯看不明白
Reply Quote
0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

WINLOGON_FATAL_ERROR (c000021a)
The Winlogon process terminated unexpectedly.
Arguments:
Arg1: ffffc0015bfe5f50, String that identifies the problem.
Arg2: 0000000000000000, Error Code.
Arg3: 0000000000000000
Arg4: 0000000000000000

Debugging Details:
------------------


BUGCHECK_STR:  0xc000021a_0

ERROR_CODE: (NTSTATUS) 0xc000021a - {

EXCEPTION_CODE: (NTSTATUS) 0xc000021a - {

EXCEPTION_PARAMETER1:  ffffc0015bfe5f50

EXCEPTION_PARAMETER2:  0000000000000000

EXCEPTION_PARAMETER3:  0000000000000000

EXCEPTION_PARAMETER4: 0

ADDITIONAL_DEBUG_TEXT:  Power ·þÎñÒâÍâÖÕÖ¹£¬Windows ±ØÐëÁ¢¼´ÖØÐÂÆô¶¯

DEFAULT_BUCKET_ID:  WIN8_DRIVER_FAULT

PROCESS_NAME:  services.exe

CURRENT_IRQL:  0

ANALYSIS_VERSION: 6.3.9600.17298 (debuggers(dbg).141024-1500) amd64fre

LAST_CONTROL_TRANSFER:  from fffff80205a05f65 to fffff802057cb1a0

STACK_TEXT:  
ffffd000`219207f8 fffff802`05a05f65 : 00000000`0000004c 00000000`c000021a ffffd000`633dd538 ffffe000`15621ed0 : nt!KeBugCheckEx
ffffd000`21920800 fffff802`05a0003a : ffffe000`13c59900 ffffd000`21920919 00000000`00000000 00000000`00000002 : nt!PopGracefulShutdown+0x2c9
ffffd000`21920840 fffff802`057d69b3 : ffffe000`13c59600 fffff802`057b3800 00000000`c0000004 fffff802`056f0200 : nt! ?? ::OKHAJAOM::`string'+0x207a
ffffd000`21920980 fffff802`057cee00 : fffff802`05c1f8e9 00000000`00000001 ffffd000`21920b98 00000000`c0000004 : nt!KiSystemServiceCopyEnd+0x13
ffffd000`21920b18 fffff802`05c1f8e9 : 00000000`00000001 ffffd000`21920b98 00000000`c0000004 ffffd000`66eca180 : nt!KiServiceLinkage
ffffd000`21920b20 fffff802`05b52727 : 00000000`00000000 00000000`00000000 ffffd000`66eca180 ffffe000`13c59740 : nt! ?? ::NNGAKEGL::`string'+0x74b99
ffffd000`21920be0 fffff802`0575004a : fffff802`0574ff90 00000000`00000000 00000000`00000002 ffffe000`13c59600 : nt!PopPolicyWorkerAction+0x63
ffffd000`21920c50 fffff802`056eb5e3 : fffff802`00000002 ffffd000`21920d10 00000000`80000000 00000000`00000000 : nt!PopPolicyWorkerThread+0xba
ffffd000`21920c90 fffff802`0577ae70 : ffffe000`10938320 ffffe000`13c59600 ffffe000`13c59600 ffffe000`0ff2d640 : nt!ExpWorkerThread+0x293
ffffd000`21920d40 fffff802`057d17c6 : ffffd000`66eca180 ffffe000`13c59600 ffffe000`1b651040 00000000`00000000 : nt!PspSystemThreadStartup+0x58
ffffd000`21920da0 00000000`00000000 : ffffd000`21921000 ffffd000`2191b000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x16


STACK_COMMAND:  kb

FOLLOWUP_IP:
nt! ?? ::OKHAJAOM::`string'+207a
fffff802`05a0003a cc              int     3

SYMBOL_STACK_INDEX:  2

SYMBOL_NAME:  nt! ?? ::OKHAJAOM::`string'+207a

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  53fe6f2e

BUCKET_ID_FUNC_OFFSET:  207a

FAILURE_BUCKET_ID:  0xc000021a_0_nt!_??_::OKHAJAOM::_string_

BUCKET_ID:  0xc000021a_0_nt!_??_::OKHAJAOM::_string_

ANALYSIS_SOURCE:  KM

FAILURE_ID_HASH_STRING:  km:0xc000021a_0_nt!_??_::okhajaom::_string_

FAILURE_ID_HASH:  {52ea3b67-e334-3513-2afe-d05f1a25cf5f}

Followup: MachineOwner
---------


IP 地址: 已记录   报告
   2015-01-10, 03:02 上午
Raymond 离线,最后访问时间: 2020/7/3 3:40:25 格蠹老雷

发帖数前10位
注册: 2005-12-19
发 贴: 1,303
Re: 分析dump文件时,栈回溯看不明白
Reply Quote
nt! ?? ::NNGAKEGL::`string'+0x74b99'
这是二进制优化而产生的副作用,老雷所谓的“代码流放”,可以通过反汇编来分析流放前属于哪个函数。

IP 地址: 已记录   报告
高端调试 » 软件调试 » 转储分析 » Re: 分析dump文件时,栈回溯看不明白

 
Legal Notice Privacy Statement Corporate Governance Corporate Governance
(C)2004-2020 ADVDBG.ORG All Rights Reserved.