C
Christian Jehle
Hi @ all,
I got the following BlueScreen but I don't knov why.
Here is the complete bluescreen I debugged with the Windows Debugging Tools:
Loading Dump File [C:\Windows\Minidump\Mini060806-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: *** Invalid ***
****************************************************************************
* Symbol loading may be unreliable without a symbol search path. *
* Use .symfix to have the debugger choose a symbol path. *
* After setting your symbol path, use .reload to refresh symbol locations. *
****************************************************************************
Executable search path is:
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
Unable to load image ntoskrnl.exe, Win32 error 2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for
ntoskrnl.exe
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Kernel base = 0x804d7000 PsLoadedModuleList = 0x805531a0
Debug session time: Thu Jun 8 20:55:34.781 2006 (GMT+2)
System Uptime: 0 days 2:54:28.367
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
Unable to load image ntoskrnl.exe, Win32 error 2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for
ntoskrnl.exe
Loading Kernel Symbols
...................................................................................................................................
Loading unloaded module list
.....................
Loading User Symbols
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 44, {85e42810, d62, 0, 0}
***** Kernel symbols are WRONG. Please fix symbols to do analysis.
*** WARNING: Unable to verify timestamp for parport.sys
*** ERROR: Module load completed but symbols could not be loaded for
parport.sys
*** WARNING: Unable to verify timestamp for hardlock.sys
*** ERROR: Module load completed but symbols could not be loaded for
hardlock.sys
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_IRP ***
*** ***
*************************************************************************
Probably caused by : parport.sys ( parport+f0f1 )
Followup: MachineOwner
---------
kd> !analyze -v
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************
MULTIPLE_IRP_COMPLETE_REQUESTS (44)
A driver has requested that an IRP be completed (IoCompleteRequest()), but
the packet has already been completed. This is a tough bug to find because
the easiest case, a driver actually attempted to complete its own packet
twice, is generally not what happened. Rather, two separate drivers each
believe that they own the packet, and each attempts to complete it. The
first actually works, and the second fails. Tracking down which drivers
in the system actually did this is difficult, generally because the trails
of the first driver have been covered by the second. However, the driver
stack for the current request can be found by examining the DeviceObject
fields in each of the stack locations.
Arguments:
Arg1: 85e42810, Address of the IRP
Arg2: 00000d62
Arg3: 00000000
Arg4: 00000000
Debugging Details:
------------------
***** Kernel symbols are WRONG. Please fix symbols to do analysis.
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_IRP ***
*** ***
*************************************************************************
MODULE_NAME: parport
FAULTING_MODULE: 804d7000 nt
DEBUG_FLR_IMAGE_TIMESTAMP: 41107b28
IRP_ADDRESS: 85e42810
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: DRIVER_FAULT
BUGCHECK_STR: 0x44
LAST_CONTROL_TRANSFER: from 804f0585 to 804f8925
STACK_TEXT:
WARNING: Stack unwind information not available. Following frames may be
wrong.
f7a26abc 804f0585 00000044 85e42810 00000d62 nt+0x21925
f7a26af4 f67eb0f1 866e8dcc f7a26b14 f67eb111 nt+0x19585
f7a26b00 f67eb111 85e42810 00000000 00000000 parport+0xf0f1
f7a26b14 f67df6d2 85e42810 00000000 00000000 parport+0xf111
f7a26b34 f67dea32 866e8d00 85e42810 f7a26b8c parport+0x36d2
f7a26b44 804eddf9 866e8d00 85e42810 85e42810 parport+0x2a32
f7a26b8c 805af563 000ccaa8 860cca90 00000000 nt+0x16df9
f7a26ba8 80521e47 860ccaa8 00000000 85e2c8ec nt+0xd8563
f7a26bcc f1faa107 85e2c8ec 85e2c8a0 f7a26bfc nt+0x4ae47
f7a26bdc f20219d0 85e2c8a0 865c78b0 f7a26c90 hardlock+0xb107
f7a26bfc f1fa2430 85e2c8a0 f7a26c90 80551380 hardlock+0x829d0
f7a26c18 8057dc0f f7a26c90 85e2c8a0 804f99be hardlock+0x3430
f7a26c40 8057e14c f201f76b f7a26c90 85e2c8a0 nt+0xa6c0f
f7a26cac 8058e5e5 804d8314 8673a770 00000000 nt+0xa714c
f7a26d34 8058e936 f7a26d70 806d0778 e33774f0 nt+0xb75e5
f7a26d50 8058ea8f f7a26d70 861c8518 8055a1fc nt+0xb7936
f7a26d74 80533dd0 861c8518 00000000 867c4da8 nt+0xb7a8f
f7a26dac 805c4a28 861c8518 00000000 00000000 nt+0x5cdd0
f7a26ddc 80540fa2 80533cd0 00000001 00000000 nt+0xeda28
00000000 00000000 00000000 00000000 00000000 nt+0x69fa2
FOLLOWUP_IP:
parport+f0f1
f67eb0f1 ?? ???
SYMBOL_STACK_INDEX: 2
FOLLOWUP_NAME: MachineOwner
SYMBOL_NAME: parport+f0f1
IMAGE_NAME: parport.sys
STACK_COMMAND: kb
THANKS,
Greedings
Christian
I got the following BlueScreen but I don't knov why.
Here is the complete bluescreen I debugged with the Windows Debugging Tools:
Loading Dump File [C:\Windows\Minidump\Mini060806-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: *** Invalid ***
****************************************************************************
* Symbol loading may be unreliable without a symbol search path. *
* Use .symfix to have the debugger choose a symbol path. *
* After setting your symbol path, use .reload to refresh symbol locations. *
****************************************************************************
Executable search path is:
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
Unable to load image ntoskrnl.exe, Win32 error 2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for
ntoskrnl.exe
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Kernel base = 0x804d7000 PsLoadedModuleList = 0x805531a0
Debug session time: Thu Jun 8 20:55:34.781 2006 (GMT+2)
System Uptime: 0 days 2:54:28.367
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
Unable to load image ntoskrnl.exe, Win32 error 2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for
ntoskrnl.exe
Loading Kernel Symbols
...................................................................................................................................
Loading unloaded module list
.....................
Loading User Symbols
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 44, {85e42810, d62, 0, 0}
***** Kernel symbols are WRONG. Please fix symbols to do analysis.
*** WARNING: Unable to verify timestamp for parport.sys
*** ERROR: Module load completed but symbols could not be loaded for
parport.sys
*** WARNING: Unable to verify timestamp for hardlock.sys
*** ERROR: Module load completed but symbols could not be loaded for
hardlock.sys
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_IRP ***
*** ***
*************************************************************************
Probably caused by : parport.sys ( parport+f0f1 )
Followup: MachineOwner
---------
kd> !analyze -v
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************
MULTIPLE_IRP_COMPLETE_REQUESTS (44)
A driver has requested that an IRP be completed (IoCompleteRequest()), but
the packet has already been completed. This is a tough bug to find because
the easiest case, a driver actually attempted to complete its own packet
twice, is generally not what happened. Rather, two separate drivers each
believe that they own the packet, and each attempts to complete it. The
first actually works, and the second fails. Tracking down which drivers
in the system actually did this is difficult, generally because the trails
of the first driver have been covered by the second. However, the driver
stack for the current request can be found by examining the DeviceObject
fields in each of the stack locations.
Arguments:
Arg1: 85e42810, Address of the IRP
Arg2: 00000d62
Arg3: 00000000
Arg4: 00000000
Debugging Details:
------------------
***** Kernel symbols are WRONG. Please fix symbols to do analysis.
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_IRP ***
*** ***
*************************************************************************
MODULE_NAME: parport
FAULTING_MODULE: 804d7000 nt
DEBUG_FLR_IMAGE_TIMESTAMP: 41107b28
IRP_ADDRESS: 85e42810
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: DRIVER_FAULT
BUGCHECK_STR: 0x44
LAST_CONTROL_TRANSFER: from 804f0585 to 804f8925
STACK_TEXT:
WARNING: Stack unwind information not available. Following frames may be
wrong.
f7a26abc 804f0585 00000044 85e42810 00000d62 nt+0x21925
f7a26af4 f67eb0f1 866e8dcc f7a26b14 f67eb111 nt+0x19585
f7a26b00 f67eb111 85e42810 00000000 00000000 parport+0xf0f1
f7a26b14 f67df6d2 85e42810 00000000 00000000 parport+0xf111
f7a26b34 f67dea32 866e8d00 85e42810 f7a26b8c parport+0x36d2
f7a26b44 804eddf9 866e8d00 85e42810 85e42810 parport+0x2a32
f7a26b8c 805af563 000ccaa8 860cca90 00000000 nt+0x16df9
f7a26ba8 80521e47 860ccaa8 00000000 85e2c8ec nt+0xd8563
f7a26bcc f1faa107 85e2c8ec 85e2c8a0 f7a26bfc nt+0x4ae47
f7a26bdc f20219d0 85e2c8a0 865c78b0 f7a26c90 hardlock+0xb107
f7a26bfc f1fa2430 85e2c8a0 f7a26c90 80551380 hardlock+0x829d0
f7a26c18 8057dc0f f7a26c90 85e2c8a0 804f99be hardlock+0x3430
f7a26c40 8057e14c f201f76b f7a26c90 85e2c8a0 nt+0xa6c0f
f7a26cac 8058e5e5 804d8314 8673a770 00000000 nt+0xa714c
f7a26d34 8058e936 f7a26d70 806d0778 e33774f0 nt+0xb75e5
f7a26d50 8058ea8f f7a26d70 861c8518 8055a1fc nt+0xb7936
f7a26d74 80533dd0 861c8518 00000000 867c4da8 nt+0xb7a8f
f7a26dac 805c4a28 861c8518 00000000 00000000 nt+0x5cdd0
f7a26ddc 80540fa2 80533cd0 00000001 00000000 nt+0xeda28
00000000 00000000 00000000 00000000 00000000 nt+0x69fa2
FOLLOWUP_IP:
parport+f0f1
f67eb0f1 ?? ???
SYMBOL_STACK_INDEX: 2
FOLLOWUP_NAME: MachineOwner
SYMBOL_NAME: parport+f0f1
IMAGE_NAME: parport.sys
STACK_COMMAND: kb
THANKS,
Greedings
Christian