@rainzhu
貌似也是这个吗?ntoskrnl.exe???
Microsoft (R) Windows Debugger Version 6.7.0005.1
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Users\Rain\Desktop81511-16130-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: *** Invalid ***
****************************************************************************
* Symbol loading may be unreliable without a symbol search path. *
* Use .symfix to have the debugger choose a symbol path. *
* After setting your symbol path, use .reload to refresh symbol locations. *
****************************************************************************
Executable search path is:
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Windows Kernel Version 7600 MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Kernel base = 0×84014000 PsLoadedModuleList = 0x8415c830
Debug session time: Mon Aug 15 14:35:50.975 2011 (GMT+8)
System Uptime: 0 days 0:00:06.817
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Loading Kernel Symbols
……………………………………………..
Loading User Symbols
Mini Kernel Dump does not contain unloaded driver list
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 124, {}
***** Kernel symbols are WRONG. Please fix symbols to do analysis.
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
Probably caused by : hardware
Followup: MachineOwner
timmy Reply:
八月 15th, 2011 at 11:02 下午
那你按我的描述,看看自己的ntoskrnl.exe文件版本是不是有点不对劲,用原始版本替换一下试试。
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
WHEA_UNCORRECTABLE_ERROR (124)
A fatal hardware error has occurred. Parameter 1 identifies the type of error
source that reported the error. Parameter 2 holds the address of the
WHEA_ERROR_RECORD structure that describes the error conditon.
Arguments:
Arg1: 00000000, MCA_ASSERT
Arg2: 895de79c, Address of WHEA_ERROR_RECORD structure
Arg3: 00000000, High 32 bits of MCi_STATUS MSR for the MCA bank that had
the error
Arg4: 00000000, Low 32 bits of MCi_STATUS MSR for the MCA bank that had
the error
Debugging Details:
——————
***** Kernel symbols are WRONG. Please fix symbols to do analysis.
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
FAULTING_MODULE: 8403c000 nt
DEBUG_FLR_IMAGE_TIMESTAMP: 0
WHEA_ERROR_RECORD: !errrec ffffffff895de79c
BUGCHECK_STR: 0x124_GenuineIntel
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WRONG_SYMBOLS
STACK_TEXT:
WARNING: Stack unwind information not available. Following frames may be wrong.
8dd13cc4 8410b0c5 895de780 841a3c28 841a3c20 nt+0×322493
8dd13ce4 8410beef 841a3c20 895de780 841a3c50 nt+0xcf0c5
8dd13d00 840aa03b 841a3c20 00000000 868e5640 nt+0xcfeef
8dd13d50 8424a9df 00000001 afb6bb65 00000000 nt+0x6e03b
8dd13d90 840fc1d9 840a9f2e 00000001 00000000 nt+0x20e9df
00000000 00000000 00000000 00000000 00000000 nt+0xc01d9
STACK_COMMAND: kb
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: hardware
IMAGE_NAME: hardware
BUCKET_ID: WRONG_SYMBOLS
Followup: MachineOwner
———