decrypter un minidump - Win NT/2K/XP - Windows & Software
Marsh Posté le 18-03-2007 à 00:24:27
Ce serait bien d'avoir un contexte non?
Et puis, installe correctement tes symboles
Marsh Posté le 18-03-2007 à 09:51:53
He bien comme tous les minidump j ai l ordi qui redemarre au bout d une heure en general. Je n ai pas l ecran bleu. Je ne fais rien de special sauf ecouter de la musique et regarder des divx. J ai testé la ram qui est bonne. Voila voila
Marsh Posté le 18-03-2007 à 10:33:29
desactive le reboot automatique et note ce qui apparait sur l'écran bleu, c'est, a mon avis, plus interessant pour savoir ce qu'il se passe.
Marsh Posté le 18-03-2007 à 10:47:56
Sinon, si tu y arrives pas avec l'écran bleu, installe correctement tes symboles et fais un !analyse -v dans le debugger.
Marsh Posté le 18-03-2007 à 11:41:38
"installe correctement tes symboles"
Ca veut dire quoi svp?
Marsh Posté le 18-03-2007 à 13:05:20
http://www.microsoft.com/whdc/devt [...] olpkg.mspx
Tu installes ça et tu dis pointes le debugger microsoft vers ce dossier par exemple.
Marsh Posté le 18-03-2007 à 14:53:24
Merci pour ton aide, Voici ce que j ai fait:
Microsoft (R) Windows Debugger Version 6.4.0007.2
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [D:\Telechargement\Mini031707-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: srv*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 1) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp1.020828-1920
Kernel base = 0x804d4000 PsLoadedModuleList = 0x8054be30
Debug session time: Sat Mar 17 21:58:59.468 2007 (GMT+1)
System Uptime: 0 days 2:12:59.068
Loading Kernel Symbols
.......................................................................................................
Loading unloaded module list
.................
Loading User Symbols
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 10000050, {8543001d, 1, 80587484, 0}
Could not read faulting driver name
Probably caused by : ntoskrnl.exe ( nt!ObpHashBuffer+1a )
Followup: MachineOwner
---------
kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: 8543001d, memory referenced.
Arg2: 00000001, value 0 = read operation, 1 = write operation.
Arg3: 80587484, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 00000000, (reserved)
Debugging Details:
------------------
Could not read faulting driver name
WRITE_ADDRESS: 8543001d
FAULTING_IP:
nt!ObpHashBuffer+1a
80587484 c1c003 rol eax,0x3
MM_INTERNAL_CODE: 0
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: DRIVER_FAULT
BUGCHECK_STR: 0x50
LAST_CONTROL_TRANSFER: from 80587434 to 80587484
STACK_TEXT:
b24c2af8 80587434 e1532de0 0000008c 80587326 nt!ObpHashBuffer+0x1a
b24c2b04 80587326 e1532de0 82bf31c0 e11f0e10 nt!ObpHashSecurityDescriptor+0x13
b24c2b30 80585d0b e1532de0 b24c2b54 00000008 nt!ObLogSecurityDescriptor+0x11
b24c2b4c 80585366 e11f0e10 e1532de0 00000001 nt!ObAssignObjectSecurityDescriptor+0x24
b24c2b60 80587531 e11f0e10 00000003 00000000 nt!SeDefaultObjectMethod+0x32
b24c2b94 805874a2 b24c2bb8 00000000 e11f0e10 nt!ObAssignSecurity+0x4e
b24c2c7c 80575dac e11f0e10 b24c2bb8 00000000 nt!ObInsertObject+0x492
b24c2d34 80596990 fffffffe 0000000a 00000001 nt!NtOpenThreadTokenEx+0x1a0
b24c2d4c 804da140 fffffffe 0000000a 00000001 nt!NtOpenThreadToken+0x17
b24c2d4c 7ffe0304 fffffffe 0000000a 00000001 nt!KiSystemService+0xc4
007df880 00000000 00000000 00000000 00000000 SharedUserData!SystemCallStub+0x4
FOLLOWUP_IP:
nt!ObpHashBuffer+1a
80587484 c1c003 rol eax,0x3
SYMBOL_STACK_INDEX: 0
FOLLOWUP_NAME: MachineOwner
SYMBOL_NAME: nt!ObpHashBuffer+1a
MODULE_NAME: nt
IMAGE_NAME: ntoskrnl.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 3d6de35c
STACK_COMMAND: kb
FAILURE_BUCKET_ID: 0x50_W_nt!ObpHashBuffer+1a
BUCKET_ID: 0x50_W_nt!ObpHashBuffer+1a
Followup: MachineOwner
---------
kd> !process 0.7
GetPointerFromAddress: unable to read from 8054c7d4
PROCESS 828b8588 SessionId: none Cid: 02a8 Peb: 7ffdf000 ParentCid: 01f8
DirBase: 0eaae000 ObjectTable: e18d2c90 HandleCount: <Data Not Accessible>
Image: lsass.exe
VadRoot 82a019c0 Vads 117 Clone 0 Private 396. Modified 1858. Locked 0.
DeviceMap e1005458
Token e18c1030
ReadMemory error: Cannot get nt!KeMaximumIncrement value.
ffdf0000: Unable to get shared data
ElapsedTime 00:00:00.000
UserTime 00:00:00.000
KernelTime 00:00:00.000
QuotaPoolUsage[PagedPool] 36688
QuotaPoolUsage[NonPagedPool] 7728
Working Set Sizes (now,min,max) (264, 50, 345) (1056KB, 200KB, 1380KB)
PeakWorkingSetSize 1309
VirtualSize 35 Mb
PeakVirtualSize 39 Mb
PageFaultCount 4951
MemoryPriority BACKGROUND
BasePriority 9
CommitCharge 845
*** Error in in reading nt!_ETHREAD @ 828d5da8
Je dois dire que je ne comprend rien
Marsh Posté le 17-03-2007 à 22:40:59
Bonsoir, j avais posté dans une autre rubrique mais on m a conseillé de venir ici pour decrypter ce minidump:
Microsoft (R) Windows Debugger Version 6.4.0007.2
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [D:\Telechargement\Mini031707-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: *** Invalid ***
****************************************************************************
* Symbol loading may be unreliable without a symbol search path. *
* Use .symfix to have the debugger choose a symbol path. *
* After setting your symbol path, use .reload to refresh symbol locations. *
****************************************************************************
Executable search path is:
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
Unable to load image ntoskrnl.exe, Win32 error 2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Windows XP Kernel Version 2600 (Service Pack 1) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Kernel base = 0x804d4000 PsLoadedModuleList = 0x8054be30
Debug session time: Sat Mar 17 21:58:59.468 2007 (GMT+1)
System Uptime: 0 days 2:12:59.068
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
Unable to load image ntoskrnl.exe, Win32 error 2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Loading Kernel Symbols
.......................................................................................................
Loading unloaded module list
.................
Loading User Symbols
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 10000050, {8543001d, 1, 80587484, 0}
***** Kernel symbols are WRONG. Please fix symbols to do analysis.
Followup: MachineOwner
---------
En esperant avoir de l aide merci