Umhlahlandlela ophelele wokuhlaziya ama-BSOD kanye nama-kernel dumps ku-Windows

Informatec Digital » Izinsiza » Umhlahlandlela ophelele wokuhlaziya ama-BSOD kanye nama-kernel dumps ku-Windows

Uma ikhompyutha ye-Windows iqina ngesikrini esiluhlaza okwesibhakabhaka, akugcini nje ngokucasula: kuvame ukuba nolwazi olubalulekile olufihliwe ku-memory dump olusitshela kahle ukuthi kwenzekeni ku-kernel. Esikhundleni sokusola i-RAM, i-BIOS, noma ukuyihlela kabusha ngokushesha, kufanelekile ukufunda ukuthi ungayifunda kanjani leyo datha.

Ngokuzijwayeza okuncane, amathuluzi afana ne-WinDbg kanye nemisebenzi efana ne- !analyze -v, .bugcheck, noma ukusetshenziswa okufanele kwezimpawu kusenza sisuke ku-"Ngithola iphutha lesikrini esiluhlaza okwesibhakabhaka" siye ku-"Ngiyazi ukuthi yimuphi umshayeli, izinsiza, noma idivayisi ebangele i-BSOD." Kulesi sihloko, sizochaza, isinyathelo ngesinyathelo nangemininingwane eminingi, ukuthi singayihlaziya kanjani i-BSOD sisebenzisa i-kernel dump yayo, ukuthi yiziphi izinhlobo zama-dumps ezikhona, ukuthi ungalungisa kanjani konke, nokuthi yimiphi imiyalo okufanele isetshenziswe ukuze uthole okuningi ekuhlaziyeni.

Iyini i-BSOD futhi yiluphi ulwazi oluqukethwe kuyo?

Uma iWindows ihlangabezana nesimo esibeka engcupheni ubuqotho besistimu futhi ingakwazi ukululama ngokuphephile, yenza ucingo lwangaphakathi lwe-kernel olubizwa nge- KeBugCheckEx . Lolu cingo yilona olubangela i-Blue Screen of Death (BSOD) edumile.

I-KeBugCheckEx ihlala ithola izimpikiswano ezinhlanu: ikhodi ye-STOP (ikhodi ye-bugcheck) kanye namapharamitha amane engeziwe anikeza umongo wobuchwepheshe wephutha. Le datha efanayo yilokho esingabe sesikuhlola.

• Esikrinini esiluhlaza okwesibhakabhaka i-classic, uma uhlelo lungalungiselelwanga ukuqala kabusha ngokuzenzakalelayo.
• Kulogi yemicimbi ye-Windows, ngaphakathi kwe-Event Viewer (ilogi yesistimu).
• Kufayela lokulahla inkumbulo (i-minidump, i-kernel dump noma i-full dump), kusetshenziswa i-WinDbg kanye nemiyalo efana ne- !analyze -v o .bugcheck.

Ikhodi ngayinye yokuhlola amaphutha inegama elingokomfanekiso kanye nenani le-hexadecimal elihambisanayo . Isibonelo, ukuhlola amaphutha i-DRIVER_POWER_STATE_FAILURE kunekhodi ethi 0x9F , kuyilapho i-RESOURCE_NOT_OWNED ihambisana ne -0xE3 . Lawa makhodi kanye nemingcele yawo kubhalwe ku-reference yekhodi yokuhlola amaphutha ye-Microsoft, okufanele uhlale uyigcina iseduze.

Ngaphezu kwekhodi, isikrini esiluhlaza okwesibhakabhaka singabonisa igama lomshayeli we-.sys ongase ahileleke . Uma kungumshayeli wesithathu (i-antivirus, ikhadi lenethiwekhi, ikhadi lehluzo, njll.), sivame ukuba nomsolwa ocacile. Uma kuvela ingxenye yesistimu ejwayelekile (ntoskrnl.exe, win32k.sys, njll.), noma uma kungaveli lutho nhlobo, kuzodingeka senze i-memory dump bese sisebenzisa i-WinDbg ukuze siphenye kabanzi.

Izinhlobo ze-memory dumps ku-Windows

Ukuze sihlaziye i-BSOD nganoma yikuphi ukujula, sidinga i-Windows ukuthi ikhiqize ifayela le-memory dump (DMP) lapho kwenzeka ukwehluleka. Leli fayela libamba isimo sesistimu ngesikhathi sephutha futhi lingaba ngezinhlobo ezahlukene.

Ezinkethweni "zokuqalisa kanye nokubuyisela" (chofoza kwesokudla ku-"Le PC / Ikhompyutha Yami" → Izakhiwo → Izilungiselelo zesistimu ezithuthukisiwe → ithebhu ethi "Okuthuthukisiwe" → inkinobho ethi "Izilungiselelo" ngaphansi kwe-"Ukuqalisa kanye nokubuyisela"), ungakhetha phakathi kwezinhlobo eziningana zama-dump. Ngayinye inezinzuzo kanye nokungalungi kwayo.

I-Memory Dump Encane (I-Minidump)

Ifomethi ye-minidump incane kunazo zonke (cishe i-64 KB) futhi ilinganiselwe kakhulu ekulungiseni amaphutha okuthuthukisiwe. Kodwa-ke, isasebenza ekutholeni ukuxilongwa okusheshayo ezimweni eziningi ze-BSOD.

Izitolo ze-minidump, phakathi kwezinye idatha:

• Umlayezo wokumisa, ikhodi yokuhlola amaphutha, kanye namapharamitha awo.
• Umongo weprosesa (PRCB) yeprosesa ebangele ukwehluleka.
• Ulwazi lwenqubo ye-Kernel (EPROSS) yenqubo esebenzayo ngesikhathi sokuphahlazeka.
• Ulwazi lwentambo ku-kernel (ETHREAD) yochungechunge olubangele ukuphahlazeka.
• I-kernel-mode call stack ngalolo chungechunge (kufika ku-16 KB).
• Uhlu lwabashayeli abalayishiwe ngesikhathi sesinqumo.
• Uhlu lwamamojula alayishiwe nalandiwe.
• Ibhulokhi yedatha yokulungisa amaphutha ngolwazi oluyisisekelo lwesistimu.

Lolu hlobo lwe-dump luvame ukulondolozwa ku- %SystemRoot%\Minidump (isibonelo, C:\Windows\Minidump ). Ezimweni eziningi zokusekela eziyisisekelo noma zokuxilonga, i-minidump ehlaziywe kahle nge- !analyze -v ingaba ngaphezu kokwanele.

I-Kernel Memory Dump

I -kernel memory dump iqukethe okuqukethwe kwe-kernel memory ngesikhathi sokuphahlazeka, ngaphandle kwezikhala zememori yenqubo yomsebenzisi. Inikeza ibhalansi ebalulekile phakathi kosayizi nemininingwane futhi ivame ukuba inketho enconywayo yokuxilonga ama-BSOD amaningi.

Le dump igcinwa njenge -MEMORY.DMP ku- %SystemRoot% (ngokuzenzakalelayo, C:\Windows\MEMORY.DMP ). Usayizi wayo uncike kwimemori esetshenziswa yi-kernel, kodwa ngokuvamile inkulu kakhulu kune-minidump futhi iphatheka kalula kune-full dump.

Ukulahla Imemori Okuphelele

I- full memory dump igcina cishe konke okuqukethwe yi-RAM ngesikhathi sephutha: i-kernel, izinqubo zomsebenzisi, njll. Iyona enemininingwane eminingi kodwa futhi yileyo ethatha isikhala esiningi futhi edinga kakhulu ngokwemigomo yokucushwa.

Ukuze i-dump ephelele isebenze, izidingo eziningana kumele zihlangatshezwe:

• El ifayela lokumatanisa kumele kube ku- ukwahlukanisa okufanayo lapho iWindows ifakiwe khona.
• Kumele kube khona isikhala sediski okungenani silingana nosayizi wememori ebonakalayo komshini.
• Ungathuthi ifayela lekhasi uye kwenye idiski ebonakalayo uma ufuna ukugwema ama-dump onakele.

Ezindaweni zokukhiqiza ezine-RAM eningi, ukulahla i-full dump kungase kungabi yinto engenakwenzeka, kodwa ezimweni eziyinkimbinkimbi kakhulu noma ezingavamile kungenza umehluko omkhulu ekutholeni inkinga.

Lungiselela iWindows ukuze ithwebule futhi iloge ama-BSOD

Ngaphambi kokuthi siqale ibhizinisi ne-WinDbg, kubalulekile ukuqinisekisa ukuthi uhlelo lukhiqiza kahle ama-dumps futhi lubhala umcimbi wesikrini esiluhlaza okwesibhakabhaka.

Efasiteleni elithi "Qala Nokubuyisela" sithola izinketho eziningana ezifanele:

• Bhala umcimbi kulogi yesistimu: kumele inikwe amandla ukuze ukuhlolwa kwephutha kuqoshwe ku-Event Viewer.
• Bhala ulwazi lokususa iphutha: lapha sikhetha i-Minidump, i-Kernel memory dump noma i-Complete memory dump.
• indlela yefayela lokulahla: okuzenzakalelayo %SystemRoot%\MEMORY.DMP kwe-kernel/full.
• Qalisa kabusha ngokuzenzakalela: Kunconywa ukuthi sikususe umaki uma sifuna bukela isikrini esiluhlaza ngokuthula futhi uqaphele okubonakala.

Kwabanye abakhiqizi noma iminyango yokusekela, njengasendabeni yama-adaptha athile enethiwekhi, umsebenzisi ucelwa ukuthi athumele ifayela lokulahla . Ngokuvamile litholakala ku -C:\Windows\memory.dmp , futhi kunconywa ukuthi ulithole ngosuku/ngesikhathi ukuze kutholakale elihambisana nokuhluleka kokugcina.

Uma esikufunayo ukukwazi ukuphoqa i-dump noma ngabe uhlelo luqandisiwe (ngaphandle kokuphendula kwekhibhodi noma igundane), kukhona futhi icebo eliwusizo kakhulu lamakhibhodi e-PS/2 (hhayi i-USB/Bluetooth), eliqukethe ukumisa irejista ukuze iqalise i-dump ngenhlanganisela yokhiye.

Phoqelela ukulahla inkunkuma usebenzisa ikhibhodi uma kwenzeka kubanda

Ukuze udale i-memory dump noma ngabe isikrini siqandisiwe ngokuphelele, ungasebenzisa inketho ye -CrashOnCtrlScroll kumakhibhodi e-PS/2. Le ndlela ayisebenzi kumakhibhodi e-USB noma e-Bluetooth.

Ku-registry, kumele sidale noma siguqule ukhiye olandelayo:

HKEY_LOCAL_MACHINE
  System
    CurrentControlSet
      Services
        i8042prt
          Parameters

Nombre: CrashOnCtrlScroll
Tipo:   REG_DWORD
Valor:  1

Ngemva kokuqala kabusha, nganoma yisiphi isikhathi (ngisho noma isikrini siqandisiwe) ungaqala ukuphahlazeka okulawulwayo bese wenza uhlelo lukhiqize i-memory dump ngokucindezela ukhiye we-CTRL ofanele bese ucindezela ukhiye we-Scroll Lock kabili . Lokhu kuwusizo kakhulu ekuphenyeni ukuphahlazeka okuqinile okungabonisi i-BSOD ngokwayo.

Isingeniso ku-WinDbg sokuhlaziya ama-kernel dumps

I-WinDbg iyithuluzi elihamba phambili le-Microsoft lokulungisa amaphutha e-kernel kanye nokuhlaziywa kwe-memory dump . Itholakala mahhala (okwamanje futhi ku-Microsoft Store njenge-WinDbg Preview) futhi, yize kungase kubonakale kuthusa ekuqaleni, ukuze uthole ukuhlaziywa kwe-BSOD kokuqala udinga ukuqonda izinketho ezimbalwa eziyisisekelo.

Singafaka i-WinDbg emshinini othintekile uqobo noma kunoma iyiphi enye ikhompyutha ; ifayela le-.dmp lingakopishwa ngenethiwekhi, nge-USB, noma licindezelwe libe ifayela le-CAB. Iprosesa kanye nenguqulo ye-Windows lapho sihlaziya khona i-dump akudingeki ukuthi ifane neyomshini ophahlazekile.

Qala i-WinDbg nge-dump kusuka kumugqa womyalo

Indlela ejwayelekile yokuvula i-memory dump ku-WinDbg ukusebenzisa umugqa womyalo onepharamitha ethi `-z` , echaza indlela eya kufayela le-dump. Lokhu kungahlanganiswa namanye amapharamitha afana nophawu noma indlela ye-binary.

windbg -y <RutaSimbolos> -i <RutaBinarios> -z <RutaDump>

Isiguquli se--v senza kusebenze imodi ye-verbose , okuwusizo kakhulu ekuboneni umongo owengeziwe. Ngaphandle kwe-WinDbg, kukhona ne -kd.exe , i-debugger esekelwe ku-console ekuvumela ukuthi wenze into efanayo kodwa ngaphandle kwesibonisi sesithombe.

kd.exe -z "Ruta\al\volcado.dmp" -y "Ruta\simbolos" -i "Ruta\busqueda\binarios"

Vula i-dump kusuka ku-interface yesithombe

Uma i-WinDbg isivele ivuliwe kumodi ye-passive, ungalayisha ifayela le-crash dump usebenzisa imenyu ye -File → Open Crash Dump noma isinqamuleli u- Ctrl+D . Khetha ifayela le-.dmp (noma ifayela le-.cab eliqukethe lona) bese i-WinDbg izolayisha ulwazi lwe-crash.

Enye indlela ukuqalisa i-WinDbg, bese uma usungaphakathi, sebenzisa umyalo othi .opendump ocacisa indlela eya kufayela le-dump bese kuba umyalo othi g (Go) ukuqala iseshini yokulungisa iphutha le-dump:

.opendump C:\Windows\Memory.dmp
g

I-WinDbg ivumela ngisho hlanza izindawo eziningi zokulahla imfucuza ngesikhathi esisodwaukwengeza amapharamitha amaningana -z emgqeni womyalo noma ngokuphinda .opendump ngemizila ehlukene kanye nokuphatha iseshini yezindawo eziningi.

Lungiselela indlela yesimboli ku-WinDbg

Ngaphandle kwezimpawu, i-WinDbg isebenza cishe ngokungacabangi. Izimpawu (.pdb) ziqukethe ulwazi lokulungisa amaphutha mayelana nemisebenzi, izakhiwo zangaphakathi, iziguquguquko, ama-offset, njll. , futhi zibalulekile ekuhlaziyweni okuthembekile, ikakhulukazi lapho usebenza ne-kernel.

Ukuze usebenzise izimpawu zomphakathi ze-Microsoft ngaphandle kokuzilanda ngesandla, umkhuba omuhle kakhulu ukumisa iseva yezimpawu ekhomba iseva esemthethweni ye-Microsoft kanye nohlu lwemibhalo yenqolobane yendawo. Isibonelo, singakha kuqala ifolda ethi C:\symbols bese kuthi, ku-WinDbg, simise indlela yezimpawu kanje:

SRV*c:\symbols*https://msdl.microsoft.com/download/symbols

Lokhu kungenziwa kusukela kumenyu ethi Ifayela → Ifayela Lezimpawu noma, ku-WinDbg Preview, kusukela ku-Ifayela → Izilungiselelo → Ukulungisa amaphutha ngokulungisa “Indlela yezimpawu ezizenzakalelayo”. Ngesikhathi sokuqala uhlaziya i-dump kusuka ohlelweni oluthile, i-debugger izolanda ngokuzenzakalelayo izimpawu ezidingekayo ku-inthanethi, okungathatha imizuzu embalwa kuye ngokuxhumeka kwakho.

Kubalulekile ukuqaphela ukuthi izimpawu zomphakathi zeMicrosoft ngezinye izikhathi azifaki lonke ulwazi lohlobo lwangaphakathi , futhi ungase ubone izixwayiso ezifana nokuthi "Isilungisi sakho asisebenzisi izimpawu ezifanele" noma izinkomba zezinhlobo ezingaxazululeki. Ekuhlaziyweni okuyisisekelo kwe-BSOD, izimpawu zomphakathi zivame ukwanele, kodwa uma udinga imininingwane eyengeziwe, kuzoba nemikhawulo.

Ukuhlaziywa kokuqala: imiyalo eyisisekelo kanye nokuhlolwa kwamaphutha

Uma i-dump isilayishiwe futhi izimpawu sezilungisiwe, i-WinDbg ivame ukubonisa i-header enolwazi lwesistimu kanye nesexwayiso esinjengokuthi "Sebenzisa i-!analyze -v ukuthola ulwazi oluningiliziwe lokulungisa amaphutha." Leso yindawo yethu yokuqala yokuhlaziya kokuqala.

Umyalo we- !analyze -v wenza ukuhlaziywa okuzenzakalelayo kwe-dump futhi uvame ukunikeza:

• Ikhodi yokuhlola iziphazamisi (isibonelo, 0xE3, 0xD1, 0x9F, 0x44…).
• Amapharamitha e-Arg1, Arg2, Arg3 kanye ne-Arg4 kusukela ekuhlolweni kwephutha.
• Imodyuli noma umshayeli okungenzeka kakhulu imbangela yokwehluleka (Probably caused by).
• Inqubo ehambisanayo ngaleso sikhathi (isibonelo, i-Teams.exe).
• I-call stack (ukulandelela i-stack) yentambo eyabangela ukuphahlazeka.
• Ulwazi lwebhakede kanye nama-hashes okwehluleka, awusizo ekuhlanganiseni amaphutha aphindaphindwayo.

Isibonelo, esimweni sokuhlola amaphutha sangempela i -RESOURCE_NOT_OWNED (0xE3) , ukuhlaziywa kungabonisa ukuthi intambo izame ukukhipha insiza okungeyona eyayo , ikhombisa i-Teams.exe njengenqubo futhi ikhombe ku- win32kbase.sys kumsebenzi ofana ne -DrvEnumDisplaySettings . Lokhu kusikisela ukuthi intambo ehlulekayo yayibuza noma ilawula izilungiselelo zokubonisa kusuka esikhaleni somsebenzisi ngokusebenzisa ungqimba lwehluzo lwe-Windows.

Ukuze singene sijule kancane emininingwaneni yekhodi yokumisa kanye nemingcele yayo, sinomyalo futhi .ukuhlola amaphuthaokuphinda kubonise ukuhlolwa kwesiphazamisi kanye nezimpikiswano ezine, okuwusizo uma sifuna ukuphinda lolo lwazi ngaphandle kokusebenzisa konke kabusha. !analyze -v.

Amacala asebenzayo: abashayeli kanye nezingxabano ezivamile

Ukuhlaziywa kwe-BSOD kuvame ukubheka ekuboneni abashayeli abanephutha noma abangasebenzi kahle , ukungqubuzana kwabashayeli, ukufinyelela okungalungile kwememori, ukuphathwa okungalungile kwama-IRP (ama-I/O Request Packets), njalo njalo. Ake sibheke ezinye izibonelo ezisebenzayo ezivela ezimweni zangempela ukuze siqonde kangcono inqubo.

I-RESOURCE_NOT_OWNED (0xE3) ehlotshaniswa namaQembu kanye ne-win32kbase.sys

Esimweni se-Windows 10 lapho, ngemva kwezinsuku eziningana zokusebenza, kuvela i-BSOD ene-bugcheck 0xE3 (RESOURCE_NOT_OWNED) , i-minikernel dump ikhombisa into efana nalokhu:

RESOURCE_NOT_OWNED (e3)
A thread tried to release a resource it did not own.
Arguments:
Arg1: <dirección recurso>
Arg2: <dirección thread>
Arg3: 0
Arg4: 0

PROCESS_NAME: Teams.exe

STACK_TEXT:
...
win32kbase!DrvEnumDisplaySettings+0x356
win32kbase!NtUserEnumDisplaySettings+0x59
win32k!NtUserEnumDisplaySettings+0x15
nt!KiSystemServiceCopyEnd+0x28
...

Lapha, i-debugger ikhombisa ukuthi ukuhlolwa kwesiphazamisi kuqalwa yintambo ehlotshaniswa ne -Teams.exe , kodwa ikhodi empeleni eku-stack ngesikhathi esibucayi ingeyakwa- win32kbase.sys , ikakhulukazi umsebenzi we -DrvEnumDisplaySettings . Lokhu akusho ukuthi ama-Teams yiwona obangela ngqo, kodwa kunalokho ama-Teams abiza i-API yomsebenzisi eholela ekuphazanyisweni noma ekukhululweni kwezinsiza ohlelweni lwezithombe.

Kulezi zinhlobo zokuxilonga, isiphetho sivame ukuba ukuthi kuyiphutha ku-stack yehluzo ze-Windows, umshayeli wevidiyo othize , noma ukusebenzisana phakathi kohlelo lokusebenza nabashayeli. Isixazululo sangempela singase sihilele ukubuyekeza abashayeli be-GPU, ukubuyekeza ama-Team, noma ngisho nokusebenzisa ama-patches athile e-Windows , kunokulinda nje ukuthi izilungise.

Umshayeli_we-IRQL_AKUNESI_ESINXESHA_NOMA_OKULINGANAYO (0xD1) no-NotMyFault

Isisetshenziswa se-Sysinternals se -NotMyFault siyithuluzi lemfundo elikuvumela ukuthi udale amaphutha e-kernel ngendlela elawulwayo ukuze ufunde ukuthi ungahlaziya kanjani izithombe-skrini. Isibonelo, uma uqalisa inketho ye- High IRQL fault (kernel mode) kusuka ku-NotMyFault bese uchofoza okuthi "Do Bug", uzophoqa iphutha le-DRIVER_IRQL_NOT_LESS_OR_EQUAL (0xD1).

Esikrinini esiluhlaza okwesibhakabhaka, sizobona into efana ne -DRIVER_IRQL_NOT_LESS_OR_EQUAL futhi mhlawumbe nomshayeli ofanele (isibonelo, i-MyFault.sys , umshayeli osetshenziswa yithuluzi). Uma i-dump isikhiqizwe futhi ivuliwe nge-WinDbg, umphumela wokuqala ungase ubukeke kanje:

Use !analyze -v to get detailed debugging information.
BugCheck D1, {e1071800, 1c, 0, f7cda403}
*** ERROR: Module load completed but symbols could not be loaded for myfault.sys
Probably caused by : memory_corruption
Followup: memory_corruption

Nakuba i-debugger ikhomba ekonakaleni kwememori , siyazi ukuthi imbangela yangempela ihlobene ne-NotMyFault kanye nomshayeli wayo. Ukuqinisekisa lokhu, singaqhubeka nokulandelela ngemiyalo efana ne- !thread ukuze sibone ukuthi yini ebiza intambo ngesikhathi sokwehluleka, kanye ne- !irp ukuze sihlaziye i-IRP ehilelekile uma ukuhlolwa kwesiphazamiso kuhlobene nokusebenza kwe-I/O.

Isibonelo, nge -`!thread <dir_thread>` singabona umkhondo we-stack we-thread bese sithola umyalelo lapho kuvela khona i-`myfault+0x403` , okubonisa lapho umshayeli wokuhlola ephambukile khona. Ukusuka lapho, singahlola i-IRP, isimo sememori, njalo njalo, njengoba nje besingenza ngephutha langempela.

Izicelo_eziphelele_ze-IRP_eziningi (0x44) kanye nezingxabano ze-USB

Esinye isibonelo esihle kakhulu yi-bugcheck Izicelo_eziphelele_ze-IRP_eziningi (0x44)Leli phutha livela uma Iphakethe Lesicelo se-IRP (I/O) ligcwaliswa izikhathi ezingaphezu kwesisodwa, ngokuvamile ngoba abashayeli ababili abahlukene bakholelwa ukuthi bane-IRP efanayo futhi bobabili bayashayela IoCompleteRequest().

Ukuhlaziywa nge- !analyze -v kungase kuveze incazelo efana nale:

MULTIPLE_IRP_COMPLETE_REQUESTS (44)
A driver has requested that an IRP be completed (IoCompleteRequest()), but
the packet has already been completed.
...
Arguments:
Arg1: <IRP_ADDRESS>
Arg2: 00000d75
Arg3: 00000000
Arg4: 00000000

Probably caused by : usbehci.sys

Ekuqaleni, okusolwayo kubonakala sengathi yi -usbehci.sys , umshayeli we-Microsoft wabalawuli be-USB EHCI. Kodwa-ke, akuvamile ukuthi iphutha libangelwe umshayeli we-Windows wasendaweni ngaphandle kokuxhumana nomuntu wesithathu. Ukuze sifinyelele ephuzwini, sisebenzisa ikheli le-IRP elinikezwe yi-bugcheck (Arg1) bese siqhuba i- !irp <IRP_ADDRESS> :

!irp 87e5a490
Irp is active with 3 stacks 3 is current (= 0x87e5a548)
...
> [ f, 0] 0 c0 8a055618 00000000 b69de300-00000000 Success Error
  \Driver\usbehci ax88172
Args: b70989c0 00000000 00220003 00000000

Emugqeni wokugcina, sibona ngokucacile intambo \Driver\usbehci ax88172 , eveza ukuthi i-IRP idlule kokubili ku -usbehci.sys kanye nomshayeli obizwa ngokuthi i- ax88172.sys , ohlotshaniswa ne-chipset ethile yenethiwekhi ye-USB (AX88172). Ngakho-ke, singaphetha ngokuthi ukungqubuzana kuvela kulo mshayeli we-USB NIC wesithathu , hhayi kumshayeli we-EHCI ojwayelekile we-Microsoft.

Kuleso simo, ikhambi lihilela ukuvuselela umshayeli we-adaptha ye-USB, ukufaka esikhundleni idivayisi, noma, uma kudingeka, ukuyisusa . Lolu hlobo lokuhlaziywa kwe-IRP luwusizo ikakhulukazi kuma-BSOD ahlobene ne-USB, isitoreji, amakhadi enethiwekhi, kanye, ngokuvamile, nanoma iyiphi ingxenye esebenzisa i-I/O enamandla.

Imiyalo ewusizo ye-WinDbg kumodi ye-kernel

Ngale kwe- !analyze -v kanye ne -.bugcheck , kunezandiso eziningana ze-WinDbg nemiyalo ewusizo kakhulu uma sifuna ukujula kancane ekulahleni i-kernel.

Ezinye zezindlela ezivame kakhulu yilezi:

• !umucu: Ibonisa ulwazi oluningiliziwe mayelana nochungechunge, okuhlanganisa i-call stack yalo, isimo, ama-IRP ahlobene, njll. Ikuvumela ukuthi ubone "izenzo zokugcina" zochungechunge olwalusebenza lapho uhlelo luphahlazeka.
• !inqubo 0 0Lokhu kubhala zonke izinqubo ezisebenzayo ngesikhathi sokuphahlazeka. Kuwusizo ekutholeni ukuthi ngabe kukhona yini izinqubo ezisolisayo, izinsizakalo, i-EDR, i-antivirus, njll., ezisebenza emshinini.
• !irp: ihlaziya i-IRP ethile bese ikhombisa umkhondo wabashayeli ebadlule kuboUmyalo we-I/O, amafulegi, njll., uyisihluthulelo seziphazamisi ezihlobene MULTIPLE_IRP_COMPLETE_REQUESTS kanye namanye amaphutha e-I/O.
• !cpuinfo: inikeza ulwazi mayelana neprosesa (umenzi, i-MHz, izisayini, izici), oluwusizo ekuqinisekiseni izindawo zehadiwe.
• !peb: ibonisa imininingwane ye-PEB (Process Environment Block), njengegama lekhompyutha, indlela yokufaka i-Windows, inani lamaprosesa, njll.
• !ithokheni: inikeza ulwazi mayelana namathokheni okuphepha, izimvume, kanye nomongo wokuphepha wenqubo noma intambo.
• .cls: isula iwindi lomyalo, njengaku-console evamile.

Ngaphezu kwalokho, izandiso eziningi zesistimu yamafayela ezithile (isb., ze-PnP, i-NTFS, njll.) zikuvumela ukuthi ukhiphe ulwazi olwengeziwe kuma-dumps. Kwezinye izimo, i-WinDbg izobonisa ukuba khona kwe- BLACKBOX* (BLACKBOXBSD, BLACKBOXNTFS, BLACKBOXPNP, BLACKBOXWINLOGON), okuyizithiyo zedatha ezengeziwe ezithathwe ngesikhathi sokuhlolwa kwesiphazamisi ukuze kube lula ukuhlonza izindawo ezithile zesistimu.

Ukusebenzisa i-Driver Verifier ukuthola abashayeli abanenkinga

Ingxenye enkulu kakhulu yamaphutha e-Windows Blue Screen of Death (BSOD) abangelwa abashayeli abanephutha noma abangahlelwanga kahle . Ukuze kutholakale lezi zinhlobo zezinkinga ngendlela ephumelelayo, uhlelo luhlanganisa ithuluzi elinamandla: I-Driver Verifier.

I -Driver Verifier isebenza ngesikhathi sangempela futhi ifaka abashayeli abakhethiwe ochungechungeni lokuhlolwa kanye nokuhlolwa kokucindezeleka: ihlola ukusetshenziswa kwememori okulungile, ukusetshenziswa kwe-kernel pool, i-IRQL, i-IRP, njll. Uma ithola ukuthi umshayeli uziphatha kabi, ingaphoqa i-BSOD elawulwayo ukuze sikwazi ukuhlaziya i-dump ecacile kakhulu, lapho umsolwa evame ukutholakala kalula khona.

Ukuze uqalise umphathi we-Driver Verifier, vele uvule umyalo osheshayo onamalungelo okuphatha bese uthayipha:

verifier

Ukusuka lapho, singakhetha ukuthi yibaphi abashayeli esifuna ukubaqinisekisa. Kuwukuhlakanipha ukuqaphela: i-Verifier ingeza imali eningi ohlelweni futhi ingalimaza ukusebenza , ngakho-ke kunconywa ukuthi kuvunyelwe ukuqinisekiswa kuphela kubashayeli abambalwa kakhulu abasolwayo esikhundleni sokukhetha yonke into ngokungakhethi.

Uma i-Verifier isiqalile i-BSOD lapho ithola ukuziphatha okungalungile, singahlaziya i-kernel dump nge-WinDbg futhi, ngethemba, sibone ngokucacile ukuthi yimuphi umshayeli obanjwe nokuthi wenzeni okungalungile. Izihloko ze-Microsoft ezibhekisela ku-Driver Verifier zichaza izinketho ezahlukene namasu okusebenzisa ngokuningiliziwe.

Iseluleko esiwusizo konjiniyela kanye nochwepheshe

Kungakhathaliseki ukuthi ungumthuthukisi womshayeli, umthuthukisi wesofthiwe osebenzisana ne-kernel, noma umane nje unguchwepheshe oqashelwa kakhulu othola zonke izikrini eziluhlaza okwesibhakabhaka zokufa, kuneziqondiso ezithile okufanele uzifunde ukuze ugweme ukulahleka ehlathini lama-BSOD.

Isinyathelo sokuqala, lapho iphutha lihlobene nekhodi yakho, ukusebenzisa ngokuhlelekile i-kernel debugger ukukhiqiza kabusha nokuhlaziya inkinga . Ngokuxhuma i-debugger emshinini oqondiwe (ngenethiwekhi, i-serial, njll.), ukuhlolwa kwephutha kuzokwenza uhlelo luyeke ngaphakathi kwe-debugger esikhundleni sokubonisa isikrini esiluhlaza okwesibhakabhaka ngqo. Ukusuka lapho, ungahlola imemori, izitaki, izakhiwo, futhi ulungise ikhodi.

Kwezinye izimo, ukuhlolwa kwamaphutha kungase kubangelwe abashayeli bezinkampani zangaphandle, ihadiwe, noma isofthiwe esingayilawuli. Kulezo zimo, umgomo ushintsha kusukela "ekulungiseni ikhodi" uye ekuhlukaniseni nasekunciphiseni inkinga.

• Khomba umshayeli osolwayo noma ingxenye yehadiwe usebenzisa i-WinDbg kanye nokuhlaziywa kwe-dump.
• Buyekeza noma ubuyisele emuva izinguqulo zomshayeli, i-BIOS, i-firmware, noma izinhlelo zokusebenza ezihlobene.
• Susa noma shintsha Amadivayisi e-USB, amakhadi ehluzo, ama-adaptha enethiwekhi kuyaphikisana.
• Ukuncika ku Isibukeli semicimbi, ama-Sysinternals, amathuluzi okuqapha kanye nokuhlaziya inethiwekhi ukuze uthole umongo owengeziwe.

Izinkinga eziningi ezibonakala ziyimfihlakalo zixazululwa ngezinqubo eziyisisekelo zokuxazulula izinkinga : ukubuyekeza amadokhumenti, ukuhlola izinguqulo zamafayela nezinsuku, ukufaka kabusha izingxenye ezibalulekile, noma ukukhubaza amamojula angqubuzanayo. Ukuhlaziya i-dump kusinika isiqondiso esicacile sokuthi kufanele sibheke kuphi futhi kuvame ukusisindisela amahora amaningi okuzama nokwenza amaphutha.

Kubalulekile futhi ukukhumbula ukuthi, ezindaweni ezifana nalezo ezibangele isigameko seCrowdStrike Falcon kanye nezinye i-EDR, imibuzo evame kakhulu iphathelene nokuthi yini ebangele i-BSOD nokuthi ungayibona kanjani ngokushesha . Ukuba ne-WinDbg elungiselelwe kahle, enezimpawu kanye nenqubo ecacile yokuvula nokuhlaziya ama-dump, kukuvumela ukuthi unciphise ngemizuzu embalwa lokho okungase kuphele "ngefomethi bese ufaka kabusha" ngaphandle kokuqonda ngempela imbangela.

Ngamafuphi, ukuhlanganisa ukucushwa okuhle kwe-memory dump, ukusetshenziswa okuhlelekile kwamathuluzi afana ne-WinDbg, i-Driver Verifier, kanye ne-Sysinternals, kanye nomkhuba wokubuyekeza ama-log kanye nama-stack ngendlela ehlelekile kuguqula izikrini eziluhlaza okwesibhakabhaka zesitha esingalindelekile zibe umthombo wolwazi olunembile kakhulu mayelana nokuthi yini ehlulekile ku-kernel , okusisiza ukuthi senze izinqumo zobuchwepheshe ezinolwazi oluningi.