首页
社区
课程
招聘
[讨论]MiDeleteAddressesInWorkingSet怎么跑到KeBugCheckEx里了?
发表于: 2010-1-26 22:10 4102

[讨论]MiDeleteAddressesInWorkingSet怎么跑到KeBugCheckEx里了?

2010-1-26 22:10
4102
今天在win7上关机的时候遇到了这个bugcheck, 感觉很罕见

MEMORY_MANAGEMENT (1a)
    # Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 00003452, The subtype of the bugcheck.
Arg2: 09c00000
Arg3: c08135f4
Arg4: 00000000

Debugging Details:
------------------


BUGCHECK_STR:  0x1a_3452

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  explorer.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from 81aa9098 to 81aa45ac

STACK_TEXT:  
a9e38c14 81aa9098 86c6e4d8 86c6e4d8 00000000 nt!MiDeleteAddressesInWorkingSet+0x389
a9e38c40 81c4cd22 b4d9baf3 839d4030 40010004 nt!MmCleanProcessAddressSpace+0x8c
a9e38cb4 81c81151 00000000 86ab9ce0 00000001 nt!PspExitThread+0x683
a9e38ccc 81aac123 86ab9ce0 a9e38cf8 a9e38d04 nt!PsExitSpecialApc+0x22
a9e38d1c 81a474e4 00000001 00000000 a9e38d34 nt!KiDeliverApc+0x28b
a9e38d1c 76ff6400 00000001 00000000 a9e38d34 nt!KiServiceExit+0x64
WARNING: Frame IP not in any known module. Following frames may be wrong.
0951f79c 00000000 00000000 00000000 00000000 0x76ff6400


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!MiDeleteAddressesInWorkingSet+389
81aa45ac cc              int     3

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  nt!MiDeleteAddressesInWorkingSet+389

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP:  4a67fd7e

IMAGE_NAME:  memory_corruption

FAILURE_BUCKET_ID:  0x1a_3452_nt!MiDeleteAddressesInWorkingSet+389

BUCKET_ID:  0x1a_3452_nt!MiDeleteAddressesInWorkingSet+389

Followup: MachineOwner


VOID
MiDeleteAddressesInWorkingSet (
    IN PEPROCESS Process
    )
{
      
       //...........................................


        if (PointerPte->u.Hard.Valid == 0) {
            KeBugCheckEx (MEMORY_MANAGEMENT,
                          0x3452,
                          (ULONG_PTR) Va,
                          (ULONG_PTR) Wsle,
                          (ULONG_PTR) PointerPte->u.Long);
        }

        //


这里有同样的问题
http://advdbg.org/forums/1/1862/ShowPost.aspx#1862
看他们讨论到最后还是不知道什么原因, 各位克曾遇到过这个?

[注意]传递专业知识、拓宽行业人脉——看雪讲师团队等你加入!

收藏
免费 0
支持
分享
最新回复 (0)
游客
登录 | 注册 方可回帖
返回
//