分析一个蓝屏dump windbg显示如下信息
Loading Dump File [E:\ftplocal\dump\MEMORY.DMP]Kernel Summary Dump File: Only kernel address space is available
Symbol search path is: D:\mysymbols;D:\symbols;SRV*D:\symbols*http://msdl.microsoft.com/download/symbolsExecutable search path is: **************************************************************************THIS DUMP FILE IS PARTIALLY CORRUPT.KdDebuggerDataBlock is not present or unreadable.**************************************************************************Unable to read PsLoadedModuleList**************************************************************************THIS DUMP FILE IS PARTIALLY CORRUPT.KdDebuggerDataBlock is not present or unreadable.**************************************************************************KdDebuggerData.KernBase < SystemRangeStartWindows XP Kernel Version 2600 MP (2 procs) Free x86 compatibleProduct: WinNt, suite: TerminalServer SingleUserTSMachine Name:Kernel base = 0x00000000 PsLoadedModuleList = 0x805644c0Debug session time: Wed Oct 12 10:44:18.671 2011 (GMT+8)System Uptime: 0 days 0:07:52.203**************************************************************************THIS DUMP FILE IS PARTIALLY CORRUPT.KdDebuggerDataBlock is not present or unreadable.**************************************************************************Unable to read PsLoadedModuleList**************************************************************************THIS DUMP FILE IS PARTIALLY CORRUPT.KdDebuggerDataBlock is not present or unreadable.**************************************************************************KdDebuggerData.KernBase < SystemRangeStartLoading Kernel SymbolsUnable to read PsLoadedModuleListGetContextState failed, 0xD0000147GetContextState failed, 0xD0000147CS descriptor lookup failedGetContextState failed, 0xD0000147GetContextState failed, 0xD0000147GetContextState failed, 0xD0000147GetContextState failed, 0xD0000147Unable to get program counterGetContextState failed, 0xD0000147Unable to get current machine context, NTSTATUS 0xC0000147GetContextState failed, 0xD0000147GetContextState failed, 0xD0000147
关键信息都看不到了
?: kd> lmstart end module nameGetContextState failed, 0xD0000147GetContextState failed, 0xD0000147GetContextState failed, 0xD0000147
这个蓝屏的原因应该是在高IRQL上访问分页内存导致的,是不是这个时候系统dump会失败呢?
文件的内容损坏了,可能有很多种原因,比如磁盘过滤驱动(全硬盘加密)干扰转储过程,传递过程损坏等...