-
-
[讨论]MiDeleteAddressesInWorkingSet怎么跑到KeBugCheckEx里了?
-
发表于: 2010-1-26 22:10 4102
-
今天在win7上关机的时候遇到了这个bugcheck, 感觉很罕见
这里有同样的问题
http://advdbg.org/forums/1/1862/ShowPost.aspx#1862
看他们讨论到最后还是不知道什么原因, 各位克曾遇到过这个?
MEMORY_MANAGEMENT (1a) # Any other values for parameter 1 must be individually examined. Arguments: Arg1: 00003452, The subtype of the bugcheck. Arg2: 09c00000 Arg3: c08135f4 Arg4: 00000000 Debugging Details: ------------------ BUGCHECK_STR: 0x1a_3452 CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT PROCESS_NAME: explorer.exe CURRENT_IRQL: 0 LAST_CONTROL_TRANSFER: from 81aa9098 to 81aa45ac STACK_TEXT: a9e38c14 81aa9098 86c6e4d8 86c6e4d8 00000000 nt!MiDeleteAddressesInWorkingSet+0x389 a9e38c40 81c4cd22 b4d9baf3 839d4030 40010004 nt!MmCleanProcessAddressSpace+0x8c a9e38cb4 81c81151 00000000 86ab9ce0 00000001 nt!PspExitThread+0x683 a9e38ccc 81aac123 86ab9ce0 a9e38cf8 a9e38d04 nt!PsExitSpecialApc+0x22 a9e38d1c 81a474e4 00000001 00000000 a9e38d34 nt!KiDeliverApc+0x28b a9e38d1c 76ff6400 00000001 00000000 a9e38d34 nt!KiServiceExit+0x64 WARNING: Frame IP not in any known module. Following frames may be wrong. 0951f79c 00000000 00000000 00000000 00000000 0x76ff6400 STACK_COMMAND: kb FOLLOWUP_IP: nt!MiDeleteAddressesInWorkingSet+389 81aa45ac cc int 3 SYMBOL_STACK_INDEX: 0 SYMBOL_NAME: nt!MiDeleteAddressesInWorkingSet+389 FOLLOWUP_NAME: MachineOwner MODULE_NAME: nt DEBUG_FLR_IMAGE_TIMESTAMP: 4a67fd7e IMAGE_NAME: memory_corruption FAILURE_BUCKET_ID: 0x1a_3452_nt!MiDeleteAddressesInWorkingSet+389 BUCKET_ID: 0x1a_3452_nt!MiDeleteAddressesInWorkingSet+389 Followup: MachineOwner
VOID MiDeleteAddressesInWorkingSet ( IN PEPROCESS Process ) { //........................................... if (PointerPte->u.Hard.Valid == 0) { KeBugCheckEx (MEMORY_MANAGEMENT, 0x3452, (ULONG_PTR) Va, (ULONG_PTR) Wsle, (ULONG_PTR) PointerPte->u.Long); } //
这里有同样的问题
http://advdbg.org/forums/1/1862/ShowPost.aspx#1862
看他们讨论到最后还是不知道什么原因, 各位克曾遇到过这个?
[注意]传递专业知识、拓宽行业人脉——看雪讲师团队等你加入!
赞赏
他的文章
看原图
赞赏
雪币:
留言: