질문과 답변
안녕하세요 w2k3 r2 덤프분석좀 부탁드려요..
2009.07.29 10:02
안녕하세요 시스템이 불규칙하게 재부팅이 되어버립니다..
덤프분석좀 부탁드릴게요.. windbg 돌렸으나 도통 뭔소린지 모르겠네요 ㅠㅠ
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck BE, {f74db97c, 3fe85121, f794abdc, b}
Probably caused by : ntkrpamp.exe ( nt!KiTrap0E+dc )
Followup: MachineOwner
---------
9: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
ATTEMPTED_WRITE_TO_READONLY_MEMORY (be)
An attempt was made to write to readonly memory. The guilty driver is on the
stack trace (and is typically the current instruction pointer).
When possible, the guilty driver's name (Unicode string) is printed on
the bugcheck screen and saved in KiBugCheckDriver.
Arguments:
Arg1: f74db97c, Virtual address for the attempted write.
Arg2: 3fe85121, PTE contents.
Arg3: f794abdc, (reserved)
Arg4: 0000000b, (reserved)
Debugging Details:
------------------
DEFAULT_BUCKET_ID: DRIVER_FAULT
BUGCHECK_STR: 0xBE
PROCESS_NAME: System
CURRENT_IRQL: 2
TRAP_FRAME: f794abdc -- (.trap 0xfffffffff794abdc)
ErrCode = 00000003
eax=f74d0005 ebx=808aeae0 ecx=f74db978 edx=0000e8cd esi=000001ff edi=6b576343
eip=808930e3 esp=f794ac50 ebp=f794ac8c iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246
nt!ExAllocatePoolWithTag+0x56b:
808930e3 897904 mov dword ptr [ecx+4],edi ds:0023:f74db97c=ffffe0b0
Resetting default scope
LAST_CONTROL_TRANSFER: from 8085ed19 to 80827c83
STACK_TEXT:
f794ab4c 8085ed19 000000be f74db97c 3fe85121 nt!KeBugCheckEx+0x1b
f794abc4 8088c7c8 00000001 f74db97c 00000000 nt!MmAccessFault+0xb25
f794abc4 808930e3 00000001 f74db97c 00000000 nt!KiTrap0E+0xdc
f794ac8c 808124de 00000000 f776f120 6b576343 nt!ExAllocatePoolWithTag+0x56b
f794ad40 808127a8 97a8a660 808ae5c0 97a5ee40 nt!CcLazyWriteScan+0x2cc
f794ad80 80880469 97a5ee40 00000000 97a8a660 nt!CcWorkerThread+0x140
f794adac 80949b7c 97a5ee40 00000000 00000000 nt!ExpWorkerThread+0xeb
f794addc 8088e092 8088037e 00000000 00000000 nt!PspSystemThreadStartup+0x2e
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!KiTrap0E+dc
8088c7c8 85c0 test eax,eax
SYMBOL_STACK_INDEX: 2
SYMBOL_NAME: nt!KiTrap0E+dc
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrpamp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 49c21e56
FAILURE_BUCKET_ID: 0xBE_nt!KiTrap0E+dc
BUCKET_ID: 0xBE_nt!KiTrap0E+dc
Followup: MachineOwner
---------
덤프분석좀 부탁드릴게요.. windbg 돌렸으나 도통 뭔소린지 모르겠네요 ㅠㅠ
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck BE, {f74db97c, 3fe85121, f794abdc, b}
Probably caused by : ntkrpamp.exe ( nt!KiTrap0E+dc )
Followup: MachineOwner
---------
9: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
ATTEMPTED_WRITE_TO_READONLY_MEMORY (be)
An attempt was made to write to readonly memory. The guilty driver is on the
stack trace (and is typically the current instruction pointer).
When possible, the guilty driver's name (Unicode string) is printed on
the bugcheck screen and saved in KiBugCheckDriver.
Arguments:
Arg1: f74db97c, Virtual address for the attempted write.
Arg2: 3fe85121, PTE contents.
Arg3: f794abdc, (reserved)
Arg4: 0000000b, (reserved)
Debugging Details:
------------------
DEFAULT_BUCKET_ID: DRIVER_FAULT
BUGCHECK_STR: 0xBE
PROCESS_NAME: System
CURRENT_IRQL: 2
TRAP_FRAME: f794abdc -- (.trap 0xfffffffff794abdc)
ErrCode = 00000003
eax=f74d0005 ebx=808aeae0 ecx=f74db978 edx=0000e8cd esi=000001ff edi=6b576343
eip=808930e3 esp=f794ac50 ebp=f794ac8c iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246
nt!ExAllocatePoolWithTag+0x56b:
808930e3 897904 mov dword ptr [ecx+4],edi ds:0023:f74db97c=ffffe0b0
Resetting default scope
LAST_CONTROL_TRANSFER: from 8085ed19 to 80827c83
STACK_TEXT:
f794ab4c 8085ed19 000000be f74db97c 3fe85121 nt!KeBugCheckEx+0x1b
f794abc4 8088c7c8 00000001 f74db97c 00000000 nt!MmAccessFault+0xb25
f794abc4 808930e3 00000001 f74db97c 00000000 nt!KiTrap0E+0xdc
f794ac8c 808124de 00000000 f776f120 6b576343 nt!ExAllocatePoolWithTag+0x56b
f794ad40 808127a8 97a8a660 808ae5c0 97a5ee40 nt!CcLazyWriteScan+0x2cc
f794ad80 80880469 97a5ee40 00000000 97a8a660 nt!CcWorkerThread+0x140
f794adac 80949b7c 97a5ee40 00000000 00000000 nt!ExpWorkerThread+0xeb
f794addc 8088e092 8088037e 00000000 00000000 nt!PspSystemThreadStartup+0x2e
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!KiTrap0E+dc
8088c7c8 85c0 test eax,eax
SYMBOL_STACK_INDEX: 2
SYMBOL_NAME: nt!KiTrap0E+dc
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrpamp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 49c21e56
FAILURE_BUCKET_ID: 0xBE_nt!KiTrap0E+dc
BUCKET_ID: 0xBE_nt!KiTrap0E+dc
Followup: MachineOwner
---------