自己写得采集卡驱动，每隔一段时间会蓝屏，我用windbg打开dmp文件，分析内容看不明白，大家帮我看看好吗？先谢谢了

davidlee2046

自己写得采集卡驱动，每隔一段时间会蓝屏，我用windbg打开dmp文件，分析内容看不明白，大家帮我看看好吗？先谢谢了 [复制链接]

Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINNT\Minidump\Mini073009-02.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

WARNING: Non-directory path: 'C:\WINNT\Minidump\Mini073009-02.dmp'
Symbol search path is: SRV*C:\Program Files\Debugging Tools for Windows (x86)\sym*http://msdl.microsoft.com/download/symbols
Executable search path is: C:\WINNT\Minidump\Mini073009-02.dmp
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Windows 2000 Kernel Version 2195 (Service Pack 4) MP (2 procs) Free x86 compatible
Machine Name:
Kernel base = 0x80400000 PsLoadedModuleList = 0x80484520
Debug session time: Thu Jul 30 16:36:49.187 2009 (GMT+8)
System Uptime: not available
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Loading Kernel Symbols
.

Press ctrl-c (cdb, kd, ntsd) or ctrl-break (windbg) to abort symbol loads that take too long.
Run !sym noisy before .reload to track down problems loading symbols.

..............................................................
...............................
Loading User Symbols
Loading unloaded module list
......................
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {ffdf, 2, 1, 80004622}

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

*** WARNING: Unable to verify timestamp for hal.dll
*** ERROR: Module load completed but symbols could not be loaded for hal.dll

Probably caused by : ntoskrnl.exe ( nt+6987c )

Followup: MachineOwner
---------

miko2007

剩余部分信息：
0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0000ffdf, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, bitfield :
        bit 0 : value 0 = read operation, 1 = write operation
        bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 80004622, address which referenced memory

Debugging Details:
------------------

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

ADDITIONAL_DEBUG_TEXT:  
Use '!findthebuild' command to search for the target build information.
If the build information is available, run '!findthebuild -s ; .reload' to set symbol path and load symbols.

MODULE_NAME: nt

FAULTING_MODULE: 80400000 nt

DEBUG_FLR_IMAGE_TIMESTAMP:  3ee650b3

WRITE_ADDRESS: unable to get nt!MmPoolCodeEnd
unable to get nt!MmSpecialPoolEnd
unable to get nt!MmPagedPoolEnd
unable to get nt!MmNonPagedPoolEnd
unable to get nt!MmNonPagedPoolStart
unable to get nt!MmSpecialPoolStart
unable to get nt!MmPagedPoolStart
unable to get nt!MmNonPagedPoolExpansionStart
unable to get nt!MmPoolCodeStart
0000ffdf

CURRENT_IRQL:  2

FAULTING_IP:
hal+3622
80004622 ??              ???

CUSTOMER_CRASH_COUNT:  2

DEFAULT_BUCKET_ID:  DRIVER_FAULT

BUGCHECK_STR:  0xA

LAST_CONTROL_TRANSFER:  from 00000000 to 8046987c

STACK_TEXT:  
ae5e8b58 00000000 0000ffdf 00000002 00000001 nt+0x6987c


STACK_COMMAND:  kb

FOLLOWUP_IP:
nt+6987c
8046987c ??              ???

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  nt+6987c

FOLLOWUP_NAME:  MachineOwner

IMAGE_NAME:  ntoskrnl.exe

BUCKET_ID:  WRONG_SYMBOLS

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0000ffdf, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, bitfield :
        bit 0 : value 0 = read operation, 1 = write operation
        bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 80004622, address which referenced memory

Debugging Details:
------------------

***** Kernel symbols are WRONG. Please fix symbols to do analysis.


ADDITIONAL_DEBUG_TEXT:  
Use '!findthebuild' command to search for the target build information.
If the build information is available, run '!findthebuild -s ; .reload' to set symbol path and load symbols.

MODULE_NAME: nt

FAULTING_MODULE: 80400000 nt

DEBUG_FLR_IMAGE_TIMESTAMP:  3ee650b3

WRITE_ADDRESS:  0000ffdf

CURRENT_IRQL:  2

FAULTING_IP:
hal+3622
80004622 ??              ???

CUSTOMER_CRASH_COUNT:  2

DEFAULT_BUCKET_ID:  DRIVER_FAULT

BUGCHECK_STR:  0xA

LAST_CONTROL_TRANSFER:  from 00000000 to 8046987c

STACK_TEXT:  
ae5e8b58 00000000 0000ffdf 00000002 00000001 nt+0x6987c


STACK_COMMAND:  kb

FOLLOWUP_IP:
nt+6987c
8046987c ??              ???

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  nt+6987c

FOLLOWUP_NAME:  MachineOwner

IMAGE_NAME:  ntoskrnl.exe

BUCKET_ID:  WRONG_SYMBOLS

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0000ffdf, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, bitfield :
        bit 0 : value 0 = read operation, 1 = write operation
        bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 80004622, address which referenced memory

Debugging Details:
------------------

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

ADDITIONAL_DEBUG_TEXT:  
Use '!findthebuild' command to search for the target build information.
If the build information is available, run '!findthebuild -s ; .reload' to set symbol path and load symbols.

MODULE_NAME: nt

FAULTING_MODULE: 80400000 nt

DEBUG_FLR_IMAGE_TIMESTAMP:  3ee650b3

WRITE_ADDRESS:  0000ffdf

CURRENT_IRQL:  2

FAULTING_IP:
hal+3622
80004622 ??              ???

CUSTOMER_CRASH_COUNT:  2

DEFAULT_BUCKET_ID:  DRIVER_FAULT

BUGCHECK_STR:  0xA

LAST_CONTROL_TRANSFER:  from 00000000 to 8046987c

STACK_TEXT:  
ae5e8b58 00000000 0000ffdf 00000002 00000001 nt+0x6987c


STACK_COMMAND:  kb

FOLLOWUP_IP:
nt+6987c
8046987c ??              ???

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  nt+6987c

FOLLOWUP_NAME:  MachineOwner

IMAGE_NAME:  ntoskrnl.exe

BUCKET_ID:  WRONG_SYMBOLS

Followup: MachineOwner
---------

0: kd> .symfix
0: kd> .reload
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Loading Kernel Symbols
...............................................................
...............................
Loading User Symbols
Loading unloaded module list
......................
0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0000ffdf, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, bitfield :
        bit 0 : value 0 = read operation, 1 = write operation
        bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 80004622, address which referenced memory

Debugging Details:
------------------

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

*** WARNING: Unable to verify timestamp for hal.dll
*** ERROR: Module load completed but symbols could not be loaded for hal.dll

ADDITIONAL_DEBUG_TEXT:  
Use '!findthebuild' command to search for the target build information.
If the build information is available, run '!findthebuild -s ; .reload' to set symbol path and load symbols.

MODULE_NAME: nt

FAULTING_MODULE: 80400000 nt

DEBUG_FLR_IMAGE_TIMESTAMP:  3ee650b3

WRITE_ADDRESS:  0000ffdf

CURRENT_IRQL:  2

FAULTING_IP:
hal+3622
80004622 ??              ???

CUSTOMER_CRASH_COUNT:  2

DEFAULT_BUCKET_ID:  DRIVER_FAULT

BUGCHECK_STR:  0xA

LAST_CONTROL_TRANSFER:  from 00000000 to 8046987c

STACK_TEXT:  
ae5e8b58 00000000 0000ffdf 00000002 00000001 nt+0x6987c


STACK_COMMAND:  kb

FOLLOWUP_IP:
nt+6987c
8046987c ??              ???

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  nt+6987c

FOLLOWUP_NAME:  MachineOwner

IMAGE_NAME:  ntoskrnl.exe

BUCKET_ID:  WRONG_SYMBOLS

Followup: MachineOwner
---------

0: kd> lmvm nt
start    end        module name
80400000 8059dd00   nt       T (no symbols)           
    Loaded symbol image file: ntoskrnl.exe
    Image path: ntoskrnl.exe
    Image name: ntoskrnl.exe
    Timestamp:        Wed Jun 11 05:42:11 2003 (3EE650B3)
    CheckSum:         001A350E
    ImageSize:        0019DD00
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4