decrypter un minidump

decrypter un minidump - Win NT/2K/XP - Windows & Software

Marsh Posté le 17-03-2007 à 22:40:59    

Bonsoir, j avais posté dans une autre rubrique mais on m a conseillé de venir ici pour decrypter ce minidump:
 
Microsoft (R) Windows Debugger  Version 6.4.0007.2
Copyright (c) Microsoft Corporation. All rights reserved.
 
 
Loading Dump File [D:\Telechargement\Mini031707-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
 
Symbol search path is: *** Invalid ***
****************************************************************************
* Symbol loading may be unreliable without a symbol search path.           *
* Use .symfix to have the debugger choose a symbol path.                   *
* After setting your symbol path, use .reload to refresh symbol locations. *
****************************************************************************
Executable search path is:  
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
*                                                                   *
* The Symbol Path can be set by:                                    *
*   using the _NT_SYMBOL_PATH environment variable.                 *
*   using the -y <symbol_path> argument when starting the debugger. *
*   using .sympath and .sympath+                                    *
*********************************************************************
Unable to load image ntoskrnl.exe, Win32 error 2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Windows XP Kernel Version 2600 (Service Pack 1) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Kernel base = 0x804d4000 PsLoadedModuleList = 0x8054be30
Debug session time: Sat Mar 17 21:58:59.468 2007 (GMT+1)
System Uptime: 0 days 2:12:59.068
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
*                                                                   *
* The Symbol Path can be set by:                                    *
*   using the _NT_SYMBOL_PATH environment variable.                 *
*   using the -y <symbol_path> argument when starting the debugger. *
*   using .sympath and .sympath+                                    *
*********************************************************************
Unable to load image ntoskrnl.exe, Win32 error 2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Loading Kernel Symbols
.......................................................................................................
Loading unloaded module list
.................
Loading User Symbols
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************
 
Use !analyze -v to get detailed debugging information.
 
BugCheck 10000050, {8543001d, 1, 80587484, 0}
 
***** Kernel symbols are WRONG. Please fix symbols to do analysis.
 
 
Followup: MachineOwner
---------
 
En esperant avoir de l aide merci

Reply

Marsh Posté le 17-03-2007 à 22:40:59   

Reply

Marsh Posté le 18-03-2007 à 00:24:27    

Ce serait bien d'avoir un contexte non?
 
Et puis, installe correctement tes symboles :)

Reply

Marsh Posté le 18-03-2007 à 09:51:53    

He bien comme tous les minidump j ai l ordi qui redemarre au bout d une heure en general. Je n ai pas l ecran bleu. Je ne fais rien de special sauf ecouter de la musique et regarder des divx. J ai testé la ram qui est bonne. Voila voila

Reply

Marsh Posté le 18-03-2007 à 10:33:29    

desactive le reboot automatique et note ce qui apparait sur l'écran bleu, c'est, a mon avis, plus interessant pour savoir ce qu'il se passe.


---------------
J'te crache ma rasade sur ta façade
Reply

Marsh Posté le 18-03-2007 à 10:47:56    

Sinon, si tu y arrives pas avec l'écran bleu, installe correctement tes symboles et fais un !analyse -v dans le debugger.

Reply

Marsh Posté le 18-03-2007 à 11:41:38    

"installe correctement tes symboles"
Ca veut dire quoi svp?

Reply

Marsh Posté le 18-03-2007 à 13:05:20    

http://www.microsoft.com/whdc/devt [...] olpkg.mspx ;)
 
Tu installes ça et tu dis pointes le debugger microsoft vers ce dossier par exemple.

Reply

Marsh Posté le 18-03-2007 à 14:53:24    

Merci pour ton aide, Voici ce que j ai fait:
 
Microsoft (R) Windows Debugger  Version 6.4.0007.2
Copyright (c) Microsoft Corporation. All rights reserved.
 
 
Loading Dump File [D:\Telechargement\Mini031707-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
 
Symbol search path is: srv*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:  
Windows XP Kernel Version 2600 (Service Pack 1) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp1.020828-1920
Kernel base = 0x804d4000 PsLoadedModuleList = 0x8054be30
Debug session time: Sat Mar 17 21:58:59.468 2007 (GMT+1)
System Uptime: 0 days 2:12:59.068
Loading Kernel Symbols
.......................................................................................................
Loading unloaded module list
.................
Loading User Symbols
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************
 
Use !analyze -v to get detailed debugging information.
 
BugCheck 10000050, {8543001d, 1, 80587484, 0}
 
 
Could not read faulting driver name
Probably caused by : ntoskrnl.exe ( nt!ObpHashBuffer+1a )
 
Followup: MachineOwner
---------
 
kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************
 
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: 8543001d, memory referenced.
Arg2: 00000001, value 0 = read operation, 1 = write operation.
Arg3: 80587484, If non-zero, the instruction address which referenced the bad memory
 address.
Arg4: 00000000, (reserved)
 
Debugging Details:
------------------
 
 
Could not read faulting driver name
 
WRITE_ADDRESS:  8543001d  
 
FAULTING_IP:  
nt!ObpHashBuffer+1a
80587484 c1c003           rol     eax,0x3
 
MM_INTERNAL_CODE:  0
 
CUSTOMER_CRASH_COUNT:  1
 
DEFAULT_BUCKET_ID:  DRIVER_FAULT
 
BUGCHECK_STR:  0x50
 
LAST_CONTROL_TRANSFER:  from 80587434 to 80587484
 
STACK_TEXT:  
b24c2af8 80587434 e1532de0 0000008c 80587326 nt!ObpHashBuffer+0x1a
b24c2b04 80587326 e1532de0 82bf31c0 e11f0e10 nt!ObpHashSecurityDescriptor+0x13
b24c2b30 80585d0b e1532de0 b24c2b54 00000008 nt!ObLogSecurityDescriptor+0x11
b24c2b4c 80585366 e11f0e10 e1532de0 00000001 nt!ObAssignObjectSecurityDescriptor+0x24
b24c2b60 80587531 e11f0e10 00000003 00000000 nt!SeDefaultObjectMethod+0x32
b24c2b94 805874a2 b24c2bb8 00000000 e11f0e10 nt!ObAssignSecurity+0x4e
b24c2c7c 80575dac e11f0e10 b24c2bb8 00000000 nt!ObInsertObject+0x492
b24c2d34 80596990 fffffffe 0000000a 00000001 nt!NtOpenThreadTokenEx+0x1a0
b24c2d4c 804da140 fffffffe 0000000a 00000001 nt!NtOpenThreadToken+0x17
b24c2d4c 7ffe0304 fffffffe 0000000a 00000001 nt!KiSystemService+0xc4
007df880 00000000 00000000 00000000 00000000 SharedUserData!SystemCallStub+0x4
 
 
FOLLOWUP_IP:  
nt!ObpHashBuffer+1a
80587484 c1c003           rol     eax,0x3
 
SYMBOL_STACK_INDEX:  0
 
FOLLOWUP_NAME:  MachineOwner
 
SYMBOL_NAME:  nt!ObpHashBuffer+1a
 
MODULE_NAME:  nt
 
IMAGE_NAME:  ntoskrnl.exe
 
DEBUG_FLR_IMAGE_TIMESTAMP:  3d6de35c
 
STACK_COMMAND:  kb
 
FAILURE_BUCKET_ID:  0x50_W_nt!ObpHashBuffer+1a
 
BUCKET_ID:  0x50_W_nt!ObpHashBuffer+1a
 
Followup: MachineOwner
---------
 
kd> !process 0.7
GetPointerFromAddress: unable to read from 8054c7d4
PROCESS 828b8588  SessionId: none  Cid: 02a8    Peb: 7ffdf000  ParentCid: 01f8
    DirBase: 0eaae000  ObjectTable: e18d2c90  HandleCount: <Data Not Accessible>
    Image: lsass.exe
    VadRoot 82a019c0 Vads 117 Clone 0 Private 396. Modified 1858. Locked 0.
    DeviceMap e1005458
    Token                             e18c1030
    ReadMemory error: Cannot get nt!KeMaximumIncrement value.
ffdf0000: Unable to get shared data
    ElapsedTime                       00:00:00.000
    UserTime                          00:00:00.000
    KernelTime                        00:00:00.000
    QuotaPoolUsage[PagedPool]         36688
    QuotaPoolUsage[NonPagedPool]      7728
    Working Set Sizes (now,min,max)  (264, 50, 345) (1056KB, 200KB, 1380KB)
    PeakWorkingSetSize                1309
    VirtualSize                       35 Mb
    PeakVirtualSize                   39 Mb
    PageFaultCount                    4951
    MemoryPriority                    BACKGROUND
    BasePriority                      9
    CommitCharge                      845
 
        *** Error in in reading nt!_ETHREAD @ 828d5da8
 
Je dois dire que je ne comprend rien :pfff:  
 
 
 


Message édité par jumpman le 18-03-2007 à 15:15:10
Reply

Sujets relatifs:

Leave a Replay

Make sure you enter the(*)required information where indicate.HTML code is not allowed