DerLukas
Cadet 2nd Year
- Registriert
- Juni 2011
- Beiträge
- 21
Hi,
ich habs jetzt endlich geschafft meine Minidump auszulesen, werde nur aus dem Ergebnis nicht schlau.
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff80002cec311, Address of the instruction which caused the bugcheck
Arg3: fffff88009f76f00, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.
Debugging Details:
------------------
***** Kernel symbols are WRONG. Please fix symbols to do analysis.
*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
TRIAGER: Could not open triage file : C:\Program Files (x86)\Windows Kits\8.0\Debuggers\x64\triage\modclass.ini, error 2
*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
ADDITIONAL_DEBUG_TEXT:
Use '!findthebuild' command to search for the target build information.
If the build information is available, run '!findthebuild -s ; .reload' to set symbol path and load symbols.
MODULE_NAME: nt
FAULTING_MODULE: fffff80002c62000 nt
DEBUG_FLR_IMAGE_TIMESTAMP: 4fa390f3
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - Die Anweisung in 0x%08lx verweist auf Speicher 0x%08lx. Der Vorgang %s konnte nicht im Speicher durchgef hrt werden.
FAULTING_IP:
nt+8a311
fffff800`02cec311 4c3b7df8 cmp r15,qword ptr [rbp-8]
CONTEXT: fffff88009f76f00 -- (.cxr 0xfffff88009f76f00)
rax=0000000000009896 rbx=fffffa8004a52120 rcx=0000000026261270
rdx=fffff80002e587f8 rsi=0000000000001d20 rdi=fffff80002e53e80
rip=fffff80002cec311 rsp=fffff88009f778e0 rbp=3a75cb3156335b2c
r8=ffffffffffffffff r9=00000000000000d9 r10=fffff80002e53e80
r11=00000000000f0000 r12=fffff80002e57da8 r13=0000000000000001
r14=0000000000000000 r15=0000000d7e52e0ba
iopl=0 nv up ei pl nz na po cy
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010207
nt+0x8a311:
fffff800`02cec311 4c3b7df8 cmp r15,qword ptr [rbp-8] ss:0018:3a75cb31`56335b24=????????????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT
BUGCHECK_STR: 0x3B
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from 0000000000000000 to fffff80002cec311
STACK_TEXT:
fffff880`09f778e0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt+0x8a311
FOLLOWUP_IP:
nt+8a311
fffff800`02cec311 4c3b7df8 cmp r15,qword ptr [rbp-8]
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: nt+8a311
FOLLOWUP_NAME: MachineOwner
IMAGE_NAME: ntoskrnl.exe
STACK_COMMAND: .cxr 0xfffff88009f76f00 ; kb
BUCKET_ID: WRONG_SYMBOLS
Followup: MachineOwner
---------
Das mit dem "Kernel symbols are WRONG. Please fix symbols to do analysis." is denk ich mal nicht so wichtig.
Ich hab irgendwie stark das Gefühl als wenn ich Windows neu draufziehen muss. Bin mir aber nicht sicher, weil ich auch auf nen Fehler in der Grafikkarte oder im RAM tippe. (Ab 10min in einem Spiel kann der Rechner zu jeder Zeit abschmieren)
Was sagt ihr dazu?
ich habs jetzt endlich geschafft meine Minidump auszulesen, werde nur aus dem Ergebnis nicht schlau.
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff80002cec311, Address of the instruction which caused the bugcheck
Arg3: fffff88009f76f00, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.
Debugging Details:
------------------
***** Kernel symbols are WRONG. Please fix symbols to do analysis.
*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
TRIAGER: Could not open triage file : C:\Program Files (x86)\Windows Kits\8.0\Debuggers\x64\triage\modclass.ini, error 2
*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
ADDITIONAL_DEBUG_TEXT:
Use '!findthebuild' command to search for the target build information.
If the build information is available, run '!findthebuild -s ; .reload' to set symbol path and load symbols.
MODULE_NAME: nt
FAULTING_MODULE: fffff80002c62000 nt
DEBUG_FLR_IMAGE_TIMESTAMP: 4fa390f3
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - Die Anweisung in 0x%08lx verweist auf Speicher 0x%08lx. Der Vorgang %s konnte nicht im Speicher durchgef hrt werden.
FAULTING_IP:
nt+8a311
fffff800`02cec311 4c3b7df8 cmp r15,qword ptr [rbp-8]
CONTEXT: fffff88009f76f00 -- (.cxr 0xfffff88009f76f00)
rax=0000000000009896 rbx=fffffa8004a52120 rcx=0000000026261270
rdx=fffff80002e587f8 rsi=0000000000001d20 rdi=fffff80002e53e80
rip=fffff80002cec311 rsp=fffff88009f778e0 rbp=3a75cb3156335b2c
r8=ffffffffffffffff r9=00000000000000d9 r10=fffff80002e53e80
r11=00000000000f0000 r12=fffff80002e57da8 r13=0000000000000001
r14=0000000000000000 r15=0000000d7e52e0ba
iopl=0 nv up ei pl nz na po cy
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010207
nt+0x8a311:
fffff800`02cec311 4c3b7df8 cmp r15,qword ptr [rbp-8] ss:0018:3a75cb31`56335b24=????????????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT
BUGCHECK_STR: 0x3B
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from 0000000000000000 to fffff80002cec311
STACK_TEXT:
fffff880`09f778e0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt+0x8a311
FOLLOWUP_IP:
nt+8a311
fffff800`02cec311 4c3b7df8 cmp r15,qword ptr [rbp-8]
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: nt+8a311
FOLLOWUP_NAME: MachineOwner
IMAGE_NAME: ntoskrnl.exe
STACK_COMMAND: .cxr 0xfffff88009f76f00 ; kb
BUCKET_ID: WRONG_SYMBOLS
Followup: MachineOwner
---------
Das mit dem "Kernel symbols are WRONG. Please fix symbols to do analysis." is denk ich mal nicht so wichtig.
Ich hab irgendwie stark das Gefühl als wenn ich Windows neu draufziehen muss. Bin mir aber nicht sicher, weil ich auch auf nen Fehler in der Grafikkarte oder im RAM tippe. (Ab 10min in einem Spiel kann der Rechner zu jeder Zeit abschmieren)
Was sagt ihr dazu?
