Разбор MEMORY.DMP Windows 2003 Сервер

Все что связано с работой этой операционной системы

Модератор: Tim308

Ответить
DRINKINS
Новичок
Сообщения: 1
Зарегистрирован: 03 мар 2020, 09:45

Разбор MEMORY.DMP Windows 2003 Сервер

Сообщение DRINKINS » 03 мар 2020, 09:51

Windows 2003 Server SP1.
Произошел сбой, при помощи WinDbg и команды "!analyze -v" получил следующую информацию, помогите понять причину произошедшего.

Microsoft (R) Windows Debugger Version 10.0.18362.1 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [F:\ОБМЕН\MEMORY.DMP]
Kernel Summary Dump File: Kernel address space is available, User address space may not be available.
Symbol search path is: srv*
Executable search path is:
*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_MMPTE_TRANSITION ***
*** ***
*************************************************************************
Windows Server 2003 Kernel Version 3790 (Service Pack 1) MP (2 procs) Free x86 compatible
Product: Server, suite: TerminalServer SingleUserTS
Built by: 3790.srv03_sp1_rtm.050324-1447
Machine Name:
Kernel base = 0x80800000 PsLoadedModuleList = 0x808a6ea8
Debug session time: Tue Mar 3 07:40:44.015 2020 (UTC + 5:00)
System Uptime: 103 days 16:38:15.248
*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_MMPTE_TRANSITION ***
*** ***
*************************************************************************
Loading Kernel Symbols
...............................................................
....................................................
Loading User Symbols


Loading unloaded module list
..................................................


************* Symbol Loading Error Summary **************
Module name Error
ntkrpamp The system cannot find the file specified


You can troubleshoot most symbol related issues by turning on symbol loading diagnostics (!sym noisy) and repeating the command that caused symbols to be loaded.
You should also verify that your symbol search path (.sympath) is correct.
For analysis of this file, run !analyze -v
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************


Unknown bugcheck code (6900)
Unknown bugcheck description
Arguments:
Arg1: f778f000
Arg2: f778f4c0
Arg3: 00000021
Arg4: 00000000


Debugging Details:
------------------


***** Kernel symbols are WRONG. Please fix symbols to do analysis.


*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_EPROCESS ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
Page fc400 too large to be in the dump file.
Page fc400 too large to be in the dump file.
Page fc400 too large to be in the dump file.
Page fc400 too large to be in the dump file.
Page fc400 too large to be in the dump file.
Page fc400 too large to be in the dump file.
Page fc400 too large to be in the dump file.
Page fc400 too large to be in the dump file.
Page fc400 too large to be in the dump file.
Page fc400 too large to be in the dump file.
Page fc400 too large to be in the dump file.
Page fc400 too large to be in the dump file.
Page fc400 too large to be in the dump file.
Page fc400 too large to be in the dump file.
Page fc400 too large to be in the dump file.
Page fc400 too large to be in the dump file.
Page fc400 too large to be in the dump file.
Page fc400 too large to be in the dump file.
Page fc400 too large to be in the dump file.
Page fc400 too large to be in the dump file.
Page fc400 too large to be in the dump file.
Page fc400 too large to be in the dump file.
Page fc400 too large to be in the dump file.
Page fc400 too large to be in the dump file.
Page fc400 too large to be in the dump file.
Page fc400 too large to be in the dump file.
Page fc400 too large to be in the dump file.
Page fc400 too large to be in the dump file.
*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
Page fc400 too large to be in the dump file.
Page fc400 too large to be in the dump file.
Page fc400 too large to be in the dump file.
Page fc400 too large to be in the dump file.
Page fc400 too large to be in the dump file.
Page fc400 too large to be in the dump file.
Page fc400 too large to be in the dump file.
Page fc400 too large to be in the dump file.
Page fc400 too large to be in the dump file.
Page fc400 too large to be in the dump file.
Page fc400 too large to be in the dump file.
Page fc400 too large to be in the dump file.
Page fc400 too large to be in the dump file.
Page fc400 too large to be in the dump file.
Page fc400 too large to be in the dump file.
Page fc400 too large to be in the dump file.
Page fc400 too large to be in the dump file.
Page fc400 too large to be in the dump file.
Page fc400 too large to be in the dump file.
Page fc400 too large to be in the dump file.
Page fc400 too large to be in the dump file.
Page fc400 too large to be in the dump file.
Page fc400 too large to be in the dump file.
Page fc400 too large to be in the dump file.
Page fc400 too large to be in the dump file.
Page fc400 too large to be in the dump file.
Page fc400 too large to be in the dump file.
Page fc400 too large to be in the dump file.
*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KTHREAD ***
*** ***
*************************************************************************
Page fc400 too large to be in the dump file.
Page fc400 too large to be in the dump file.
Page fc400 too large to be in the dump file.
Page fc400 too large to be in the dump file.
Page fc400 too large to be in the dump file.
Page fc400 too large to be in the dump file.
Page fc400 too large to be in the dump file.
Page fc400 too large to be in the dump file.
Page fc400 too large to be in the dump file.
Page fc400 too large to be in the dump file.
Page fc400 too large to be in the dump file.
Page fc400 too large to be in the dump file.
Page fc400 too large to be in the dump file.
Page fc400 too large to be in the dump file.
Page fc400 too large to be in the dump file.
Page fc400 too large to be in the dump file.
Page fc400 too large to be in the dump file.
Page fc400 too large to be in the dump file.
Page fc400 too large to be in the dump file.
Page fc400 too large to be in the dump file.
Page fc400 too large to be in the dump file.
Page fc400 too large to be in the dump file.
Page fc400 too large to be in the dump file.
Page fc400 too large to be in the dump file.
Page fc400 too large to be in the dump file.
Page fc400 too large to be in the dump file.
Page fc400 too large to be in the dump file.
Page fc400 too large to be in the dump file.
*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************


KEY_VALUES_STRING: 1



PROCESSES_ANALYSIS: 1


SERVICE_ANALYSIS: 1


STACKHASH_ANALYSIS: 1


TIMELINE_ANALYSIS: 1



DUMP_CLASS: 1


DUMP_QUALIFIER: 401


BUILD_VERSION_STRING: 3790.srv03_sp1_rtm.050324-1447


SYSTEM_MANUFACTURER: FUJITSU SIEMENS


SYSTEM_PRODUCT_NAME: D2836-S1


SYSTEM_VERSION:


BIOS_VENDOR: FUJITSU SIEMENS // Phoenix Technologies Ltd.


BIOS_VERSION: 6.00 R1.09.2836.S1


BIOS_DATE: 05/20/2011


BASEBOARD_MANUFACTURER: FUJITSU SIEMENS


BASEBOARD_PRODUCT: D2836-S1


BASEBOARD_VERSION: S26361-D2836-S1


ADDITIONAL_DEBUG_TEXT:
You can run '.symfix; .reload' to try to fix the symbol path and load symbols.


WRONG_SYMBOLS_TIMESTAMP: 42435b14


WRONG_SYMBOLS_SIZE: 253000


FAULTING_MODULE: 80800000 nt
DEBUG_FLR_IMAGE_TIMESTAMP: 42435b14

DUMP_TYPE: 1


BUGCHECK_P1: fffffffff778f000


BUGCHECK_P2: fffffffff778f4c0


BUGCHECK_P3: 21


BUGCHECK_P4: 0


CPU_COUNT: 2


CPU_MHZ: bb8


CPU_VENDOR: GenuineIntel


CPU_FAMILY: 6


CPU_MODEL: 17


CPU_STEPPING: a


CPU_MICROCODE: 0,0,0,0 (F,M,S,R) SIG: A0B'00000000 (cache) 0'00000000 (init)


CURRENT_IRQL: 0


ANALYSIS_SESSION_HOST: PROG


ANALYSIS_SESSION_TIME: 03-03-2020 11:38:29.0163


ANALYSIS_VERSION: 10.0.18362.1 amd64fre


LAST_CONTROL_TRANSFER: from ba00da09 to 80827451


STACK_TEXT:
Page fc400 too large to be in the dump file.
Page fc400 too large to be in the dump file.
Page fc400 too large to be in the dump file.
Page fc400 too large to be in the dump file.
Page fc400 too large to be in the dump file.
Page fc400 too large to be in the dump file.
Page fc400 too large to be in the dump file.
Page fc400 too large to be in the dump file.
Page fc400 too large to be in the dump file.
Page fc400 too large to be in the dump file.
Page fc400 too large to be in the dump file.
Page fc400 too large to be in the dump file.
Page fc400 too large to be in the dump file.
Page fc400 too large to be in the dump file.
Page fc400 too large to be in the dump file.
Page fc400 too large to be in the dump file.
Page fc400 too large to be in the dump file.
Page fc400 too large to be in the dump file.
Page fc400 too large to be in the dump file.
Page fc400 too large to be in the dump file.
Page fc400 too large to be in the dump file.
Page fc400 too large to be in the dump file.
Page fc400 too large to be in the dump file.
Page fc400 too large to be in the dump file.
Page fc400 too large to be in the dump file.
Page fc400 too large to be in the dump file.
Page fc400 too large to be in the dump file.
Page fc400 too large to be in the dump file.
WARNING: Stack unwind information not available. Following frames may be wrong.
b9090ab8 ba00da09 00006900 f778f000 f778f4c0 nt!KeBugCheckEx+0x1b
b9090ae8 ba00dbb2 89e057d0 00000021 b9090b00 ABPCICSW+0x6a09
00000000 00000000 00000000 00000000 00000000 ABPCICSW+0x6bb2



THREAD_SHA1_HASH_MOD_FUNC: d5a95496d20a8c0bb3debcfaf774cb9e5616bcf7


THREAD_SHA1_HASH_MOD_FUNC_OFFSET: 99f12f0c4c6dfa2593a50277d933cdba20c4c6d0


THREAD_SHA1_HASH_MOD: 0e23d9e169a985fd24611dea5d497e0412e3ad72


FOLLOWUP_IP:
ABPCICSW+6a09
ba00da09 8b461c mov eax,dword ptr [esi+1Ch]


FAULT_INSTR_CODE: 851c468b


SYMBOL_STACK_INDEX: 1


FOLLOWUP_NAME: MachineOwner


STACK_COMMAND: .thread ; .cxr ; kb


BUGCHECK_STR: 42435B14


EXCEPTION_CODE: (Win32) 0x42435b14 (1111710484) - <Unable to get error code text>


EXCEPTION_CODE_STR: 42435B14


EXCEPTION_STR: WRONG_SYMBOLS


PROCESS_NAME: ntoskrnl.wrong.symbols.exe


IMAGE_NAME: ntoskrnl.wrong.symbols.exe


MODULE_NAME: nt_wrong_symbols


SYMBOL_NAME: nt_wrong_symbols!42435B14253000


BUCKET_ID: WRONG_SYMBOLS_X86_3790.srv03_sp1_rtm.050324-1447_TIMESTAMP_050325-002804


DEFAULT_BUCKET_ID: WRONG_SYMBOLS_X86_3790.srv03_sp1_rtm.050324-1447_TIMESTAMP_050325-002804


PRIMARY_PROBLEM_CLASS: WRONG_SYMBOLS


FAILURE_BUCKET_ID: WRONG_SYMBOLS_X86_3790.srv03_sp1_rtm.050324-1447_TIMESTAMP_050325-002804_42435B14_nt_wrong_symbols!42435B14253000


TARGET_TIME: 2020-03-03T02:40:44.000Z


OSBUILD: 3790


OSSERVICEPACK: 1000


SERVICEPACK_NUMBER: 1


OS_REVISION: 0


SUITE_MASK: 272


PRODUCT_TYPE: 3


OSPLATFORM_TYPE: x86


OSNAME: Windows Server 2003


OSEDITION: Windows Server 2003 Server (Service Pack 1) TerminalServer SingleUserTS


OS_LOCALE:


USER_LCID: 0


OSBUILD_TIMESTAMP: 2005-03-25 05:28:04


BUILDOSVER_STR: 5.2.3790.srv03_sp1_rtm.050324-1447


ANALYSIS_SESSION_ELAPSED_TIME: af2


ANALYSIS_SOURCE: KM


FAILURE_ID_HASH_STRING: km:wrong_symbols_x86_3790.srv03_sp1_rtm.050324-1447_timestamp_050325-002804_42435b14_nt_wrong_symbols!42435b14253000


FAILURE_ID_HASH: {3a24cf58-7094-d3a9-b7b9-e2f02769a331}


Followup: MachineOwner
---------

Аватара пользователя
DesignerMix
Администратор
Администратор
Сообщения: 6505
Зарегистрирован: 25 апр 2014, 10:51
Откуда: Белгород
Контактная информация:

Разбор MEMORY.DMP Windows 2003 Сервер

Сообщение DesignerMix » 03 мар 2020, 11:40

Kernel symbols are WRONG. Please fix symbols to do analysis.
Почитайте статью как указать путь до символов - https://support.microsoft.com/ru-ru/hel ... ndows-if-a

Ответить

Вернуться в «Windows»

Кто сейчас на конференции

Сейчас этот форум просматривают: нет зарегистрированных пользователей и 1 гость