使用dump文件分析系统蓝屏原因.docx

使用dump文件分析系统蓝屏原因出处： /746253/709702目录1什么是dump文件2如何让系统在崩溃时记录dump文件3使用Debugging Tools for Windows (windebug)来分析dump文件3.1什么是windebug3.2windebug最新版安装方法（此方法为在线安装）3.3windebug的symbol符号文件的路径配置3.4dump文件的分析1什么是dump文件当系统崩溃在蓝屏瞬间，系统会形成一个扩展名为dmp的存储器转储文件，默认存储位置为C：WINDOWSMinidmp。2如何让系统在崩溃时记录dump文件A右击“我的电脑”选择“属性”，在“系统属性”对话框中选择“高级”B.在“启动和故障恢复”中选择“设置”，具体设置如下图所示3使用Debugging Tools for Windows (windebug)来分析dump文件3.1什么是windebugwindebug是微软发布的一款相当优秀的源码级(source-level)调试工具，可以用于Kernel模式调试和用户模式调试，还可以调试Dump文件。3.2 windebug最新版安装方法（此方法为在线安装）A.从/download/en/details.aspx?displaylang=en&id=8279下载B.安装netFramework2.0C.运行1中下载的winsdk_web.exe3.3windebug的symbol符号文件的路径配置为windebug设置symbol路径可以提高对dump文件分析的准确性，给我们更多有价值的错误信息。A在/en-us/windows/hardware/gg463028.aspx根据实际需要下载相应的版本B安装下载的symbol符号文件3.4dump文件的分析详细代码如下Loading Dump File C:Documents and Settingstest-pc桌面dump文件Mini102011-01.dmpMini Kernel Dump File: Only registers and stack trace are availableSymbol search path is: C:WINDOWSSymbols;SRV*C:Windowssymbols*/download/symbolsExecutable search path is:Windows XP Kernel Version 2600 (Service Pack 3) MP (4 procs) Free x86 compatibleProduct: WinNt, suite: TerminalServer SingleUserTSBuilt by: 2600.xpsp_sp3_gdr.101209-1647Machine Name:Kernel base = 0x804d8000 PsLoadedModuleList = 0x8055e720Debug session time: Thu Oct 20 14:37:16.343 2011 (UTC + 8:00)System Uptime: 0 days 0:00:43.312Loading Kernel Symbols.Loading User SymbolsLoading unloaded module list.* WARNING: Unable to verify timestamp for nv4_disp.dll* ERROR: Module load completed but symbols could not be loaded for nv4_disp.dll*Bugcheck Analysis*Use !analyze -v to get detailed debugging information.BugCheck100000EA, 88a18908, 88ced810, b84fbcbc, 1ERROR - could not read driver name for bugcheck parameter 3Probably caused by : nv4_disp.dll ( nv4_disp+28526 )Followup: MachineOwner-3: kd> !analyze -v*Bugcheck Analysis*THREAD_STUCK_IN_DEVICE_DRIVER_M (100000ea)The device driver is spinning in an infinite loop, most likely waiting forhardware to become idle. This usually indicates problem with the hardwareitself or with the device driver programming the hardware incorrectly.If the kernel debugger is connected and running when watchdog detects atimeout condition then DbgBreakPoint() will be called instead of KeBugCheckEx()and detailed message including bugcheck arguments will be printed to thedebugger. This way we can identify an offending thread, set breakpoints in it,and hit go to return to the spinning code to debug it further. BecauseKeBugCheckEx() is not called the .bugcheck directive will not return bugcheckinformation in this case. The arguments are already printed out to the kerneldebugger. You can also retrieve them from a global variable viadd watchdog!g_WdBugCheckData l5 (use dq on NT64).On MP machines it is possible to hit a timeout when the spinning thread isinterrupted by hardware interrupt and ISR or DPC routine is running at the timeof the bugcheck (this is because the timeouts work item can be delivered andhandled on the second CPU and the same time). If this is the case you will haveto look deeper at the offending threads stack (e.g. using dds) to determinespinning code which caused the timeout to occur.Arguments:Arg1: 88a18908, Pointer to a stuck thread object.Do .thread then kb on it to findthe hung location.Arg2: 88ced810, Pointer to a DEFERRED_WATCHDOG object.Arg3: b84fbcbc, Pointer to offending driver name.Arg4: 00000001, Number of times intercepted bugcheck 0xEA was hit (see notes).Debugging Details:-ERROR - could not read driver name for bugcheck parameter 3FAULTING_THREAD:88a18908FAULTING_IP:nv4_disp+28526bd03a526 ?IMAGE_NAME:nv4_disp.dllDEBUG_FLR_IMAGE_TIMESTAMP:4bb7e5d1MODULE_NAME:nv4_dispFAULTING_MODULE: bd012000 nv4_dispDEFAULT_BUCKET_ID:GRAPHICS_DRIVER_FAULTCUSTOMER_CRASH_COUNT:1BUGCHECK_STR:0xEAPROCESS_NAME:csrss.exeLAST_CONTROL_TRANSFER:from e3a33010 to bd03a526STACK_TEXT:WARNING: Stack unwind information not available. Following frames may be wrong.b816758c e3a33010 e3a33010 e3a33010 00000080 nv4_disp+0x28526b8167590 e3a33010 e3a33010 00000080 bd04e0b0 0xe3a33010b8167594 e3a33010 00000080 bd04e0b0 00000000 0xe3a33010b8167598 00000000 bd04e0b0 00000000 00000000 0xe3a33010STACK_COMMAND:.thread 0xffffffff88a18908 ; kbFOLLOWUP_IP:nv4_disp+28526bd03a52