Witam od pewnego czasu mam problem z windows xp professional sp3 jeden z plików MiniDump. Wnioskuję że to problemy ze sterownikami.
Log dump’a:
Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [E]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: ***Invalid***
****************************************************************************
* Symbol loading may be unreliable without a symbol search path. *
* Use .symfix to have the debugger choose a symbol path. *
* After setting your symbol path, use .reload to refresh symbol locations. *
****************************************************************************
Executable search path is:
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Windows XP Kernel Version 2600 (Service Pack 3) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055b1c0
Debug session time: Tue Dec 13 12:51:27.781 2011 (GMT+1)
System Uptime: 0 days 0:06:51.359
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Loading Kernel Symbols
...............................................................
.........................................................
Loading User Symbols
Loading unloaded module list
..........
Unable to load image PSINProt.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for PSINProt.sys
*** ERROR: Module load completed but symbols could not be loaded for PSINProt.sys
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 10000050, {b97c7480, 1, ba52a4c0, 3}
***** Kernel symbols are WRONG. Please fix symbols to do analysis.
*************************************************************************
******
******
***Your debugger is not using the correct symbols***
******
***In order for this command to work properly, your symbol path***
***must point to .pdb files that have full type information.***
******
***Certain .pdb files (such as the public OS symbols) do not***
***contain the required information. Contact the group that***
***provided you with these symbols if you need this command to***
***work.***
******
***Type referenced: nt!_KPRCB***
******
*************************************************************************
*************************************************************************
******
******
***Your debugger is not using the correct symbols***
******
***In order for this command to work properly, your symbol path***
***must point to .pdb files that have full type information.***
******
***Certain .pdb files (such as the public OS symbols) do not***
***contain the required information. Contact the group that***
***provided you with these symbols if you need this command to***
***work.***
******
***Type referenced: nt!KPRCB***
******
*************************************************************************
*************************************************************************
******
******
***Your debugger is not using the correct symbols***
******
***In order for this command to work properly, your symbol path***
***must point to .pdb files that have full type information.***
******
***Certain .pdb files (such as the public OS symbols) do not***
***contain the required information. Contact the group that***
***provided you with these symbols if you need this command to***
***work.***
******
***Type referenced: nt!_KPRCB***
******
*************************************************************************
*************************************************************************
******
******
***Your debugger is not using the correct symbols***
******
***In order for this command to work properly, your symbol path***
***must point to .pdb files that have full type information.***
******
***Certain .pdb files (such as the public OS symbols) do not***
***contain the required information. Contact the group that***
***provided you with these symbols if you need this command to***
***work.***
******
***Type referenced: nt!KPRCB***
******
*************************************************************************
*************************************************************************
******
******
***Your debugger is not using the correct symbols***
******
***In order for this command to work properly, your symbol path***
***must point to .pdb files that have full type information.***
******
***Certain .pdb files (such as the public OS symbols) do not***
***contain the required information. Contact the group that***
***provided you with these symbols if you need this command to***
***work.***
******
***Type referenced: nt!_KPRCB***
******
*************************************************************************
*** WARNING: Unable to verify timestamp for psinknc.sys
*** ERROR: Module load completed but symbols could not be loaded for psinknc.sys
*************************************************************************
******
******
***Your debugger is not using the correct symbols***
******
***In order for this command to work properly, your symbol path***
***must point to .pdb files that have full type information.***
******
***Certain .pdb files (such as the public OS symbols) do not***
***contain the required information. Contact the group that***
***provided you with these symbols if you need this command to***
***work.***
******
***Type referenced: nt!_KPRCB***
******
*************************************************************************
*************************************************************************
******
******
***Your debugger is not using the correct symbols***
******
***In order for this command to work properly, your symbol path***
***must point to .pdb files that have full type information.***
******
***Certain .pdb files (such as the public OS symbols) do not***
***contain the required information. Contact the group that***
***provided you with these symbols if you need this command to***
***work.***
******
***Type referenced: nt!_KPRCB***
******
*************************************************************************
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
Probably caused by : PSINProt.sys ( PSINProt+64c0 )
Followup: MachineOwner
---------
kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: b97c7480, memory referenced.
Arg2: 00000001, value 0 = read operation, 1 = write operation.
Arg3: ba52a4c0, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 00000003, (reserved)
Debugging Details:
------------------
***** Kernel symbols are WRONG. Please fix symbols to do analysis.
*************************************************************************
******
******
***Your debugger is not using the correct symbols***
******
***In order for this command to work properly, your symbol path***
***must point to .pdb files that have full type information.***
******
***Certain .pdb files (such as the public OS symbols) do not***
***contain the required information. Contact the group that***
***provided you with these symbols if you need this command to***
***work.***
******
***Type referenced: nt!_KPRCB***
******
*************************************************************************
*************************************************************************
******
******
***Your debugger is not using the correct symbols***
******
***In order for this command to work properly, your symbol path***
***must point to .pdb files that have full type information.***
******
***Certain .pdb files (such as the public OS symbols) do not***
***contain the required information. Contact the group that***
***provided you with these symbols if you need this command to***
***work.***
******
***Type referenced: nt!KPRCB***
******
*************************************************************************
*************************************************************************
******
******
***Your debugger is not using the correct symbols***
******
***In order for this command to work properly, your symbol path***
***must point to .pdb files that have full type information.***
******
***Certain .pdb files (such as the public OS symbols) do not***
***contain the required information. Contact the group that***
***provided you with these symbols if you need this command to***
***work.***
******
***Type referenced: nt!_KPRCB***
******
*************************************************************************
*************************************************************************
******
******
***Your debugger is not using the correct symbols***
******
***In order for this command to work properly, your symbol path***
***must point to .pdb files that have full type information.***
******
***Certain .pdb files (such as the public OS symbols) do not***
***contain the required information. Contact the group that***
***provided you with these symbols if you need this command to***
***work.***
******
***Type referenced: nt!KPRCB***
******
*************************************************************************
*************************************************************************
******
******
***Your debugger is not using the correct symbols***
******
***In order for this command to work properly, your symbol path***
***must point to .pdb files that have full type information.***
******
***Certain .pdb files (such as the public OS symbols) do not***
***contain the required information. Contact the group that***
***provided you with these symbols if you need this command to***
***work.***
******
***Type referenced: nt!_KPRCB***
******
*************************************************************************
*************************************************************************
******
******
***Your debugger is not using the correct symbols***
******
***In order for this command to work properly, your symbol path***
***must point to .pdb files that have full type information.***
******
***Certain .pdb files (such as the public OS symbols) do not***
***contain the required information. Contact the group that***
***provided you with these symbols if you need this command to***
***work.***
******
***Type referenced: nt!_KPRCB***
******
*************************************************************************
*************************************************************************
******
******
***Your debugger is not using the correct symbols***
******
***In order for this command to work properly, your symbol path***
***must point to .pdb files that have full type information.***
******
***Certain .pdb files (such as the public OS symbols) do not***
***contain the required information. Contact the group that***
***provided you with these symbols if you need this command to***
***work.***
******
***Type referenced: nt!_KPRCB***
******
*************************************************************************
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
ADDITIONAL_DEBUG_TEXT:
Use '!findthebuild' command to search for the target build information.
If the build information is available, run '!findthebuild -s ; .reload' to set symbol path and load symbols.
FAULTING_MODULE: 804d7000 nt
DEBUG_FLR_IMAGE_TIMESTAMP: 4db8a89c
WRITE_ADDRESS: unable to get nt!MmSpecialPoolStart
unable to get nt!MmSpecialPoolEnd
unable to get nt!MmPoolCodeStart
unable to get nt!MmPoolCodeEnd
b97c7480
FAULTING_IP:
PSINProt+64c0
ba52a4c0 8901 mov dword ptr [ecx],eax
MM_INTERNAL_CODE: 3
CUSTOMER_CRASH_COUNT: 2
DEFAULT_BUCKET_ID: DRIVER_FAULT
BUGCHECK_STR: 0x50
LAST_CONTROL_TRANSFER: from ba52b247 to ba52a4c0
STACK_TEXT:
WARNING: Stack unwind information not available. Following frames may be wrong.
f6be5ccc ba52b247 8676c1e0 86e6e8a8 ba53b280 PSINProt+0x64c0
f6be5ce8 ba52b697 05d8cc58 86e6e860 86e6e878 PSINProt+0x7247
f6be5d14 f3707675 00000000 00000000 86e6e878 PSINProt+0x7697
f6be5d28 f3704dae 86707b58 866facc8 86e6e878 psinknc+0xd675
f6be5d48 f3705cd3 86e6e860 00000050 f6be5d94 psinknc+0xadae
f6be5d58 f3705e1c 00000003 86e6e860 00000050 psinknc+0xbcd3
f6be5d94 f370a90c 00000000 00000000 86ae5da8 psinknc+0xbe1c
f6be5dac 8057aeff 86e81e78 00000000 00000000 psinknc+0x1090c
f6be5ddc 804f88ea f370a8cf 86e81e78 00000000 nt+0xa3eff
00000000 00000000 00000000 00000000 00000000 nt+0x218ea
STACK_COMMAND: kb
FOLLOWUP_IP:
PSINProt+64c0
ba52a4c0 8901 mov dword ptr [ecx],eax
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: PSINProt+64c0
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: PSINProt
IMAGE_NAME: PSINProt.sys
BUCKET_ID: WRONG_SYMBOLS
Followup: MachineOwner
---------