Advertisement

01.21.2008 at 12:06PM PST, ID: 23099203
[x]
Attachment Details
[x]
The Solution Rating System

With so many solutions, how can you tell which solutions are most likely to help you and which ones are not? To provide you with a tool to use, we rate our solutions based on various elements that most accurately determine if a solution is a quality solution. To explain what factors affect the solution rating, here are the elements we take into consideration when formulating our solution rating.

  • The Grade of the Solution
  • The Zone Rank of the Expert Providing the Solution
  • The Number of Author and Expert Comments
  • The Number of Experts Contributing
  • The Feedback of the Community

Your Input Matters
Because of the way the system is set up, the most important variable in this equation is you. As a member of Experts Exchange, you are able to cast your vote on the quality of the solutions in regard to how complete, accurate, helpful and easy to understand each solution is. When you provide your feedback, each rating is adjusted accordingly. So, if you see a solution that has a poor rating that you think is a good solution, let us know by rating it. As you do, the rating will be adjusted and will become more accurate for other members of our site.

If you have any suggestions that you would like to make for our rating system, please ask a question in the Suggestions Zone of Community Support.

Thank you!
8.2

Interpreting WinDbg Crash Dump output

Asked by djMundy in Debugging Software for Development, Microsoft Windows Operating Systems, Microsoft Operating Systems

Tags: , ,

Hi,

I'd like some hints about reading the output from WinDbg when reading crash dumps. I've found lots of information on the Internet about using WinDbg, setting up the symbols, etc, but they all end there without telling me what the output actually means. Lately I've had several different clients with BSODs and would love to know which parts of the WinDbg output I should be looking at for hints.

I've attached the latest bugcheck that I'm working on as a guide, bearing in mind that I'm more interested in knowing how to read the output myself that finding the cause of this particular crash.

Thanks,
DanielStart Free Trial 
1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
11:
12:
13:
14:
15:
16:
17:
18:
19:
20:
21:
22:
23:
24:
25:
26:
27:
28:
29:
30:
31:
32:
33:
34:
35:
36:
37:
38:
39:
40:
41:
42:
43:
44:
45:
46:
47:
48:
49:
50:
51:
52:
53:
54:
55:
56:
57:
58:
59:
60:
61:
62:
63:
64:
65:
66:
67:
68:
69:
70:
71:
72:
73:
74:
75:
76:
77:
78:
79:
80:
81:
82:
83:
84:
85:
86:
87:
88:
89:
90:
91:
92:
93:
94:
95:
96:
97:
98:
99:
100:
101:
102:
103:
104:
105:
106:
107:
108:
109:
110:
111:
112:
113:
114:
115:
116:
117:
118:
119:
120:
121:
122:
123:
124:
125:
126:
127:
128:
129:
130:
131:
132:
133:
134:
135:
136:
137:
138:
139:
140:
141:
142:
143:
144:
145:
146:
147:
148:
149:
150:
151:
152:
153:
154:
155:
156:
157:
158:
159:
160:
161:
162:
163:
164:
165:
166:
167:
168:
169:
170:
171:
172:
173:
174:
175:
176:
177:
178:
179:
180:
181:
182:
183:
184:
185:
186:
187:
188:
189:
190:
191:
192:
193:
194:
195:
196:
197:
198:
199:
200:
201:
202:
203:
204:
205:
206:
207:
208:
209:
210:
211:
212:
213:
214:
215:
216:
217:
218:
219:
220:
221:
222:
223:
224:
225:
226:
227:
228:
229:
230:

Microsoft (R) Windows Debugger Version 6.8.0004.0 X86
Copyright (c) Microsoft Corporation. All rights reserved.
 
 
Loading Dump File [C:\WINDOWS\MEMORY.DMP]
Kernel Complete Dump File: Full address space is available
 
Symbol search path is: SRV*C:\WebSymbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows Server 2003 Kernel Version 3790 (Service Pack 2) MP (2 procs) Free x86 compatible
Product: LanManNt, suite: SmallBusiness TerminalServer SmallBusinessRestricted SingleUserTS
Built by: 3790.srv03_sp2_gdr.070304-2240
Kernel base = 0x80800000 PsLoadedModuleList = 0x808a6ea8
Debug session time: Fri Jan 18 21:03:54.189 2008 (GMT+11)
System Uptime: 1 days 13:05:48.929
WARNING: Process directory table base 3FBE1620 doesn't match CR3 00506000
WARNING: Process directory table base 3FBE1620 doesn't match CR3 00506000
Loading Kernel Symbols
.............................................................................................................
Loading User Symbols
...............................Unable to read NT module Base Name string at 0019fc78 - NTSTATUS 0xC0000147
.....Unable to read NT module Base Name string at 001a60b0 - NTSTATUS 0xC0000147
Missing image name, possible paged-out or corrupt data.
.Unable to read NT module Base Name string at 001a5eaa - NTSTATUS 0xC0000147
Missing image name, possible paged-out or corrupt data.
...
Loading unloaded module list
.................
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************
 
Use !analyze -v to get detailed debugging information.
 
BugCheck 7F, {8, 80042000, 0, 0}
 
*** ERROR: Module load completed but symbols could not be loaded for TmPreFlt.sys
*** ERROR: Module load completed but symbols could not be loaded for ofant.sys
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: kernel32!pNlsUserInfo                         ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: kernel32!pNlsUserInfo                         ***
***                                                                   ***
*************************************************************************
Probably caused by : storport.sys ( storport!StorPortDebugPrint+1c )
 
Followup: MachineOwner
---------
 
0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************
 
UNEXPECTED_KERNEL_MODE_TRAP (7f)
This means a trap occurred in kernel mode, and it's a trap of a kind
that the kernel isn't allowed to have/catch (bound trap) or that
is always instant death (double fault).  The first number in the
bugcheck params is the number of the trap (8 = double fault, etc)
Consult an Intel x86 family manual to learn more about what these
traps are. Here is a *portion* of those codes:
If kv shows a taskGate
        use .tss on the part before the colon, then kv.
Else if kv shows a trapframe
        use .trap on that value
Else
        .trap on the appropriate frame will show where the trap was taken
        (on x86, this will be the ebp that goes with the procedure KiTrap)
Endif
kb will then show the corrected stack.
Arguments:
Arg1: 00000008, EXCEPTION_DOUBLE_FAULT
Arg2: 80042000
Arg3: 00000000
Arg4: 00000000
 
Debugging Details:
------------------
 
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: kernel32!pNlsUserInfo                         ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: kernel32!pNlsUserInfo                         ***
***                                                                   ***
*************************************************************************
 
BUGCHECK_STR:  0x7f_8
 
TSS:  00000028 -- (.tss 0x28)
eax=80871f39 ebx=8641d2c8 ecx=8641d288 edx=f74f20bc esi=8641d288 edi=86800000
eip=80883973 esp=b6ef0000 ebp=b6ef0244 iopl=0         nv up ei ng nz ac pe nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010296
nt!_SEH_prolog+0x23:
80883973 50              push    eax
Resetting default scope
 
DEFAULT_BUCKET_ID:  DRIVER_FAULT
 
PROCESS_NAME:  NTRtScan.exe
 
CURRENT_IRQL:  2
 
LAST_CONTROL_TRANSFER:  from 80872237 to 80883973
 
STACK_TEXT:  
b6ef0244 80872237 f726c85c 0000005a 00000004 nt!_SEH_prolog+0x23
b6ef0264 f726c888 f726c85c 0000005a 00000004 nt!vDbgPrintExWithPrefix+0x1b
b6ef0280 f74eb852 00000004 f74eb7ca 8641d2c8 storport!StorPortDebugPrint+0x1c
b6ef02b4 f74f03ba 86759004 0141d288 b6ef02e0 arc!RxPushMessageUnitQueueFib+0x28
b6ef02c4 f74ed05e 8641d288 8641d288 85270000 arc!SendMessageUnitQueueFib+0x16
b6ef02e0 f74ed6dc 000001f6 8641d288 00000000 arc!SendFib+0xf6
b6ef0304 f74eda72 000001f6 0141d288 00000000 arc!SendRawIoFib+0xa8
b6ef0344 f7266090 86759004 8527c82c b6ef037c arc!StartIo+0x102
b6ef0354 f7266d15 8673c1a0 8527c82c 00000000 storport!RaCallMiniportStartIo+0x1e
b6ef037c f7266dad 8673c0e8 86760de0 866aee18 storport!RaidAdapterPostScatterGatherExecute+0xab
b6ef0394 80a5b147 8673c030 00000000 8641d05c storport!RaidpAdapterContinueScatterGather+0x3f
b6ef03c0 f726a3f0 8641d05c 8673c030 866aedf8 hal!HalBuildScatterGatherList+0x1c7
b6ef03f0 f7266e2d 8673c2ac 8673c030 866aedf8 storport!RaidDmaBuildScatterGatherList+0x2c
b6ef042c f7266e7f 8673c2ac 8641d000 b6ef045c storport!RaidAdapterScatterGatherExecute+0x49
b6ef043c f7271ae0 8673c0e8 8641d010 85362d10 storport!RaidAdapterExecuteXrb+0x21
b6ef045c f726b80b 00000000 00000001 b6ef047c storport!RaUnitStartIo+0x98
b6ef0490 f7270179 8527c82c 01362d10 00000000 storport!RaidStartIoPacket+0x85
b6ef04b0 f7272083 86760d68 85362d10 f7274510 storport!RaidUnitSubmitRequest+0x47
b6ef04cc f726a62e 86760d68 85362d10 84f4ae20 storport!RaUnitScsiIrp+0xc1
b6ef04e8 8081df65 86760cb0 85362d10 8527c780 storport!RaDriverScsiIrp+0x5c
b6ef04fc f7242607 8527c780 9bde7000 b6ef0540 nt!IofCallDriver+0x45
b6ef050c f72422b2 8527c780 863490e8 84f4af44 CLASSPNP!SubmitTransferPacket+0xbb
b6ef0540 f7242533 00000000 00001000 84f4ae20 CLASSPNP!ServiceTransferRequest+0x1e4
b6ef0564 8081df65 86349030 00000000 8673ff38 CLASSPNP!ClassReadWrite+0x159
b6ef0578 f74c80cf 86725e00 84f4af68 b6ef059c nt!IofCallDriver+0x45
b6ef0588 8081df65 8675ed00 84f4ae20 84f4af8c PartMgr!PmReadWrite+0x95
b6ef059c f7317053 84f4ae20 86742a20 84f4ae20 nt!IofCallDriver+0x45
b6ef05b8 8081df65 86725d48 84f4ae20 84f4afb0 ftdisk!FtDiskReadWrite+0x1a9
b6ef05cc f72c08bc 867641c0 866fcb48 8671fb88 nt!IofCallDriver+0x45
b6ef05e4 8081df65 8671fb88 84f4ae20 84f4ae20 volsnap!VolSnapRead+0x52
b6ef05f8 f7b50a62 b6ef08dc b6ef07dc f7b508d9 nt!IofCallDriver+0x45
b6ef0604 f7b508d9 b6ef08dc 8671fb88 c0be7000 Ntfs!NtfsSingleAsync+0x91
b6ef07dc f7b51156 b6ef08dc 84f4ae20 866fcb48 Ntfs!NtfsNonCachedIo+0x2db
b6ef08c8 f7b51079 b6ef08dc 84f4ae20 00000001 Ntfs!NtfsCommonRead+0xaf5
b6ef0a74 8081df65 861fe020 84f4ae20 866eddf0 Ntfs!NtfsFsdRead+0x113
b6ef0a88 f7220c45 866eddf0 84f4afd4 00000000 nt!IofCallDriver+0x45
b6ef0ab0 8081df65 86703c70 84f4ae20 863f1f38 fltmgr!FltpDispatch+0x6f
b6ef0ac4 f75b8bfe b6ef0ae0 8081df65 86472b48 nt!IofCallDriver+0x45
WARNING: Stack unwind information not available. Following frames may be wrong.
b6ef0acc 8081df65 86472b48 84f4ae20 84f4ae20 TmPreFlt+0x1bfe
b6ef0ae0 b9efdd40 85b96020 84f4ae20 b6ef0b40 nt!IofCallDriver+0x45
b6ef0af4 b9efd8c8 85b96020 84f4ae20 00000000 ofant+0xdd40
00000000 00000000 00000000 00000000 00000000 ofant+0xd8c8
 
 
STACK_COMMAND:  .tss 0x28 ; kb
 
FOLLOWUP_IP: 
storport!StorPortDebugPrint+1c
f726c888 5d              pop     ebp
 
SYMBOL_STACK_INDEX:  2
 
SYMBOL_NAME:  storport!StorPortDebugPrint+1c
 
FOLLOWUP_NAME:  MachineOwner
 
MODULE_NAME: storport
 
IMAGE_NAME:  storport.sys
 
DEBUG_FLR_IMAGE_TIMESTAMP:  45d69bb4
 
FAILURE_BUCKET_ID:  0x7f_8_storport!StorPortDebugPrint+1c
 
BUCKET_ID:  0x7f_8_storport!StorPortDebugPrint+1c
 
Followup: MachineOwner
---------
[+][-]01.21.2008 at 04:42PM PST, ID: 20710978

View this solution now by starting your 7-day free trial. Setting up your free trial is quick, easy, and secure. We will return you to this solution, unlocked, when you're done.

 

About this solution

Zones: Debugging Software for Development, Microsoft Windows Operating Systems, Microsoft Operating Systems
Tags: Microsoft, Windows Server, 2003
Sign Up Now!
Solution Provided By: MrHusy
Participating Experts: 1
Solution Grade: A
 
 
 
Loading Advertisement...
20080716-EE-VQP-32 / EE_QW_2_20070628