none
Windows Server 2016 蓝屏 RRS feed

  • 问题

  • 【情景描述】:辅助域控蓝屏日志

    【诉求】:IMAGE_NAME:  ntoskrnl.exe,何故,如何解决?

    Mini Kernel Dump File: Only registers and stack trace are available

    WARNING: Inaccessible path: 'set _NT_SYMBOL_PATH=srvDownstreamStorehttps://msdl.microsoft.com/download/symbols'
    Symbol search path is: set _NT_SYMBOL_PATH=srvDownstreamStorehttps://msdl.microsoft.com/download/symbols;SRV*C:\Symbols* http://msdl.microsoft.com/download/symbols
    Executable search path is: 
    Unable to load image \SystemRoot\system32\ntoskrnl.exe, Win32 error 0n2
    *** WARNING: Unable to verify timestamp for ntoskrnl.exe
    *** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
    Windows 7 Kernel Version 14393 MP (8 procs) Free x64
    Product: LanManNt, suite: TerminalServer DataCenter SingleUserTS
    Built by: 14393.3383.amd64fre.rs1_release.191125-1816
    Machine Name:
    Kernel base = 0xfffff802`89a83000 PsLoadedModuleList = 0xfffff802`89d86020
    Debug session time: Mon Jun  8 08:31:42.657 2020 (UTC + 8:00)
    System Uptime: 1 days 9:23:52.259
    Unable to load image \SystemRoot\system32\ntoskrnl.exe, Win32 error 0n2
    *** WARNING: Unable to verify timestamp for ntoskrnl.exe
    *** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
    Loading Kernel Symbols
    .

    Press ctrl-c (cdb, kd, ntsd) or ctrl-break (windbg) to abort symbol loads that take too long.
    Run !sym noisy before .reload to track down problems loading symbols.

    ..............................................................
    ................................................................
    .......................
    Loading User Symbols
    Loading unloaded module list
    ........
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck 1A, {41792, fffffe0102a41c40, 2000000000000, 0}

    ***** Kernel symbols are WRONG. Please fix symbols to do analysis.

    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Your debugger is not using the correct symbols                 ***
    ***                                                                   ***
    ***    In order for this command to work properly, your symbol path   ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!_KPRCB                                     ***
    ***                                                                   ***
    *************************************************************************
    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Your debugger is not using the correct symbols                 ***
    ***                                                                   ***
    ***    In order for this command to work properly, your symbol path   ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!_KPRCB                                     ***
    ***                                                                   ***
    *************************************************************************
    Probably caused by : ntoskrnl.exe ( nt+15ce00 )

    Followup: MachineOwner
    ---------

    1: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    MEMORY_MANAGEMENT (1a)
        # Any other values for parameter 1 must be individually examined.
    Arguments:
    Arg1: 0000000000041792, The subtype of the bugcheck.
    Arg2: fffffe0102a41c40
    Arg3: 0002000000000000
    Arg4: 0000000000000000

    Debugging Details:
    ------------------

    ***** Kernel symbols are WRONG. Please fix symbols to do analysis.

    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Your debugger is not using the correct symbols                 ***
    ***                                                                   ***
    ***    In order for this command to work properly, your symbol path   ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!_KPRCB                                     ***
    ***                                                                   ***
    *************************************************************************
    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Your debugger is not using the correct symbols                 ***
    ***                                                                   ***
    ***    In order for this command to work properly, your symbol path   ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!_KPRCB                                     ***
    ***                                                                   ***
    *************************************************************************

    ADDITIONAL_DEBUG_TEXT:  
    Use '!findthebuild' command to search for the target build information.
    If the build information is available, run '!findthebuild -s ; .reload' to set symbol path and load symbols.

    MODULE_NAME: nt

    FAULTING_MODULE: fffff80289a83000 nt

    DEBUG_FLR_IMAGE_TIMESTAMP:  5ddcba81

    BUGCHECK_STR:  0x1a_41792

    CUSTOMER_CRASH_COUNT:  1

    DEFAULT_BUCKET_ID:  DRIVER_FAULT_SERVER_MINIDUMP

    CURRENT_IRQL:  0

    LAST_CONTROL_TRANSFER:  from fffff80289b0f330 to fffff80289bdfe00

    STACK_TEXT:  
    ffffdb00`e9c46708 fffff802`89b0f330 : 00000000`0000001a 00000000`00041792 fffffe01`02a41c40 00020000`00000000 : nt+0x15ce00
    ffffdb00`e9c46710 00000000`0000001a : 00000000`00041792 fffffe01`02a41c40 00020000`00000000 00000000`00000000 : nt+0x8c330
    ffffdb00`e9c46718 00000000`00041792 : fffffe01`02a41c40 00020000`00000000 00000000`00000000 ffffdb00`e9c467d0 : 0x1a
    ffffdb00`e9c46720 fffffe01`02a41c40 : 00020000`00000000 00000000`00000000 ffffdb00`e9c467d0 00000000`00000139 : 0x41792
    ffffdb00`e9c46728 00020000`00000000 : 00000000`00000000 ffffdb00`e9c467d0 00000000`00000139 00000000`00000000 : 0xfffffe01`02a41c40
    ffffdb00`e9c46730 00000000`00000000 : ffffdb00`e9c467d0 00000000`00000139 00000000`00000000 00000000`00000000 : 0x20000`00000000


    STACK_COMMAND:  kb

    FOLLOWUP_IP: 
    nt+15ce00
    fffff802`89bdfe00 48894c2408      mov     qword ptr [rsp+8],rcx

    SYMBOL_STACK_INDEX:  0

    SYMBOL_NAME:  nt+15ce00

    FOLLOWUP_NAME:  MachineOwner

    IMAGE_NAME:  ntoskrnl.exe

    BUCKET_ID:  WRONG_SYMBOLS

    Followup: MachineOwner
    ---------

    1: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    MEMORY_MANAGEMENT (1a)
        # Any other values for parameter 1 must be individually examined.
    Arguments:
    Arg1: 0000000000041792, The subtype of the bugcheck.
    Arg2: fffffe0102a41c40
    Arg3: 0002000000000000
    Arg4: 0000000000000000

    Debugging Details:
    ------------------

    ***** Kernel symbols are WRONG. Please fix symbols to do analysis.

    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Your debugger is not using the correct symbols                 ***
    ***                                                                   ***
    ***    In order for this command to work properly, your symbol path   ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!_KPRCB                                     ***
    ***                                                                   ***
    *************************************************************************
    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Your debugger is not using the correct symbols                 ***
    ***                                                                   ***
    ***    In order for this command to work properly, your symbol path   ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!_KPRCB                                     ***
    ***                                                                   ***
    *************************************************************************

    ADDITIONAL_DEBUG_TEXT:  
    Use '!findthebuild' command to search for the target build information.
    If the build information is available, run '!findthebuild -s ; .reload' to set symbol path and load symbols.

    MODULE_NAME: nt

    FAULTING_MODULE: fffff80289a83000 nt

    DEBUG_FLR_IMAGE_TIMESTAMP:  5ddcba81

    BUGCHECK_STR:  0x1a_41792

    CUSTOMER_CRASH_COUNT:  1

    DEFAULT_BUCKET_ID:  DRIVER_FAULT_SERVER_MINIDUMP

    CURRENT_IRQL:  0

    LAST_CONTROL_TRANSFER:  from fffff80289b0f330 to fffff80289bdfe00

    STACK_TEXT:  
    ffffdb00`e9c46708 fffff802`89b0f330 : 00000000`0000001a 00000000`00041792 fffffe01`02a41c40 00020000`00000000 : nt+0x15ce00
    ffffdb00`e9c46710 00000000`0000001a : 00000000`00041792 fffffe01`02a41c40 00020000`00000000 00000000`00000000 : nt+0x8c330
    ffffdb00`e9c46718 00000000`00041792 : fffffe01`02a41c40 00020000`00000000 00000000`00000000 ffffdb00`e9c467d0 : 0x1a
    ffffdb00`e9c46720 fffffe01`02a41c40 : 00020000`00000000 00000000`00000000 ffffdb00`e9c467d0 00000000`00000139 : 0x41792
    ffffdb00`e9c46728 00020000`00000000 : 00000000`00000000 ffffdb00`e9c467d0 00000000`00000139 00000000`00000000 : 0xfffffe01`02a41c40
    ffffdb00`e9c46730 00000000`00000000 : ffffdb00`e9c467d0 00000000`00000139 00000000`00000000 00000000`00000000 : 0x20000`00000000


    STACK_COMMAND:  kb

    FOLLOWUP_IP: 
    nt+15ce00
    fffff802`89bdfe00 48894c2408      mov     qword ptr [rsp+8],rcx

    SYMBOL_STACK_INDEX:  0

    SYMBOL_NAME:  nt+15ce00

    FOLLOWUP_NAME:  MachineOwner

    IMAGE_NAME:  ntoskrnl.exe

    BUCKET_ID:  WRONG_SYMBOLS

    Followup: MachineOwner
    ---------

    1: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    MEMORY_MANAGEMENT (1a)
        # Any other values for parameter 1 must be individually examined.
    Arguments:
    Arg1: 0000000000041792, The subtype of the bugcheck.
    Arg2: fffffe0102a41c40
    Arg3: 0002000000000000
    Arg4: 0000000000000000

    Debugging Details:
    ------------------

    ***** Kernel symbols are WRONG. Please fix symbols to do analysis.

    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Your debugger is not using the correct symbols                 ***
    ***                                                                   ***
    ***    In order for this command to work properly, your symbol path   ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!_KPRCB                                     ***
    ***                                                                   ***
    *************************************************************************
    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Your debugger is not using the correct symbols                 ***
    ***                                                                   ***
    ***    In order for this command to work properly, your symbol path   ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!_KPRCB                                     ***
    ***                                                                   ***
    *************************************************************************

    ADDITIONAL_DEBUG_TEXT:  
    Use '!findthebuild' command to search for the target build information.
    If the build information is available, run '!findthebuild -s ; .reload' to set symbol path and load symbols.

    MODULE_NAME: nt

    FAULTING_MODULE: fffff80289a83000 nt

    DEBUG_FLR_IMAGE_TIMESTAMP:  5ddcba81

    BUGCHECK_STR:  0x1a_41792

    CUSTOMER_CRASH_COUNT:  1

    DEFAULT_BUCKET_ID:  DRIVER_FAULT_SERVER_MINIDUMP

    CURRENT_IRQL:  0

    LAST_CONTROL_TRANSFER:  from fffff80289b0f330 to fffff80289bdfe00

    STACK_TEXT:  
    ffffdb00`e9c46708 fffff802`89b0f330 : 00000000`0000001a 00000000`00041792 fffffe01`02a41c40 00020000`00000000 : nt+0x15ce00
    ffffdb00`e9c46710 00000000`0000001a : 00000000`00041792 fffffe01`02a41c40 00020000`00000000 00000000`00000000 : nt+0x8c330
    ffffdb00`e9c46718 00000000`00041792 : fffffe01`02a41c40 00020000`00000000 00000000`00000000 ffffdb00`e9c467d0 : 0x1a
    ffffdb00`e9c46720 fffffe01`02a41c40 : 00020000`00000000 00000000`00000000 ffffdb00`e9c467d0 00000000`00000139 : 0x41792
    ffffdb00`e9c46728 00020000`00000000 : 00000000`00000000 ffffdb00`e9c467d0 00000000`00000139 00000000`00000000 : 0xfffffe01`02a41c40
    ffffdb00`e9c46730 00000000`00000000 : ffffdb00`e9c467d0 00000000`00000139 00000000`00000000 00000000`00000000 : 0x20000`00000000


    STACK_COMMAND:  kb

    FOLLOWUP_IP: 
    nt+15ce00
    fffff802`89bdfe00 48894c2408      mov     qword ptr [rsp+8],rcx

    SYMBOL_STACK_INDEX:  0

    SYMBOL_NAME:  nt+15ce00

    FOLLOWUP_NAME:  MachineOwner

    IMAGE_NAME:  ntoskrnl.exe

    BUCKET_ID:  WRONG_SYMBOLS

    Followup: MachineOwner
    ---------

    1: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    MEMORY_MANAGEMENT (1a)
        # Any other values for parameter 1 must be individually examined.
    Arguments:
    Arg1: 0000000000041792, The subtype of the bugcheck.
    Arg2: fffffe0102a41c40
    Arg3: 0002000000000000
    Arg4: 0000000000000000

    Debugging Details:
    ------------------

    ***** Kernel symbols are WRONG. Please fix symbols to do analysis.

    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Your debugger is not using the correct symbols                 ***
    ***                                                                   ***
    ***    In order for this command to work properly, your symbol path   ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!_KPRCB                                     ***
    ***                                                                   ***
    *************************************************************************
    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Your debugger is not using the correct symbols                 ***
    ***                                                                   ***
    ***    In order for this command to work properly, your symbol path   ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!_KPRCB                                     ***
    ***                                                                   ***
    *************************************************************************

    ADDITIONAL_DEBUG_TEXT:  
    Use '!findthebuild' command to search for the target build information.
    If the build information is available, run '!findthebuild -s ; .reload' to set symbol path and load symbols.

    MODULE_NAME: nt

    FAULTING_MODULE: fffff80289a83000 nt

    DEBUG_FLR_IMAGE_TIMESTAMP:  5ddcba81

    BUGCHECK_STR:  0x1a_41792

    CUSTOMER_CRASH_COUNT:  1

    DEFAULT_BUCKET_ID:  DRIVER_FAULT_SERVER_MINIDUMP

    CURRENT_IRQL:  0

    LAST_CONTROL_TRANSFER:  from fffff80289b0f330 to fffff80289bdfe00

    STACK_TEXT:  
    ffffdb00`e9c46708 fffff802`89b0f330 : 00000000`0000001a 00000000`00041792 fffffe01`02a41c40 00020000`00000000 : nt+0x15ce00
    ffffdb00`e9c46710 00000000`0000001a : 00000000`00041792 fffffe01`02a41c40 00020000`00000000 00000000`00000000 : nt+0x8c330
    ffffdb00`e9c46718 00000000`00041792 : fffffe01`02a41c40 00020000`00000000 00000000`00000000 ffffdb00`e9c467d0 : 0x1a
    ffffdb00`e9c46720 fffffe01`02a41c40 : 00020000`00000000 00000000`00000000 ffffdb00`e9c467d0 00000000`00000139 : 0x41792
    ffffdb00`e9c46728 00020000`00000000 : 00000000`00000000 ffffdb00`e9c467d0 00000000`00000139 00000000`00000000 : 0xfffffe01`02a41c40
    ffffdb00`e9c46730 00000000`00000000 : ffffdb00`e9c467d0 00000000`00000139 00000000`00000000 00000000`00000000 : 0x20000`00000000


    STACK_COMMAND:  kb

    FOLLOWUP_IP: 
    nt+15ce00
    fffff802`89bdfe00 48894c2408      mov     qword ptr [rsp+8],rcx

    SYMBOL_STACK_INDEX:  0

    SYMBOL_NAME:  nt+15ce00

    FOLLOWUP_NAME:  MachineOwner

    IMAGE_NAME:  ntoskrnl.exe

    BUCKET_ID:  WRONG_SYMBOLS

    Followup: MachineOwner
    ---------

    1: kd> lmvm nt
    start             end                 module name
    fffff802`89a83000 fffff802`8a29f000   nt       T (no symbols)           
        Loaded symbol image file: ntoskrnl.exe
        Image path: \SystemRoot\system32\ntoskrnl.exe
        Image name: ntoskrnl.exe
        Timestamp:        Tue Nov 26 13:39:13 2019 (5DDCBA81)
        CheckSum:         0077714B
        ImageSize:        0081C000
        Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4
    1: kd> !process
    GetPointerFromAddress: unable to read from fffff80289cf7d20

    2020年6月8日 2:09

全部回复