疑問 - 藍色當機畫面有記錄檔(日誌)可查嗎?

[pc123]

--------------------
閱讀本主題的最佳解答
--------------------


XP OS下(因"藍底白字"畫面下無法拍照存檔)這問題困擾很久了!

[a471]

作者: pc123

XP OS下(因"藍底白字"畫面下無法拍照存檔)這問題困擾很久了!

這訊息只是一個"反應"，有時候只有比爾蓋茲才知道那有啥意義...

你可以去XP的"錯誤報告"找找有無被記錄下來..

[mini]

X:\WINDOWS\Minidump
下就是當機後記憶體傾印資訊

可用 WinDbg 分析
http://forum.slime.com.tw/thread210423.html
http://forum.slime.com.tw/thread209456.html

[pc123]

Toshiba NB (satellite a60)
OS XP
問題很明顯是VGA卡有問題!(常常一開機就跳出藍底白字)再開機一次就可以進入XP了.
煩請高手幫小弟分析一下記錄檔


Microsoft (R) Windows Debugger Version 6.8.0004.0 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini072607-02.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: *** Invalid ***
****************************************************************************
* Symbol loading may be unreliable without a symbol search path. *
* Use .symfix to have the debugger choose a symbol path. *
* After setting your symbol path, use .reload to refresh symbol locations. *
****************************************************************************
Executable search path is:
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Kernel base = 0x804d8000 PsLoadedModuleList = 0x8055b620
Debug session time: Thu Jul 26 12:05:14.875 2007 (GMT+8)
System Uptime: 0 days 0:09:08.442
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Loading Kernel Symbols
.............................................................................................................................
Loading User Symbols
Mini Kernel Dump does not contain unloaded driver list
Unable to load image ati2dvag.dll, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ati2dvag.dll
*** ERROR: Module load completed but symbols could not be loaded for ati2dvag.dll
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck EA, {824f6558, 826cf008, 826d4218, 1}

*** WARNING: Unable to verify timestamp for mssmbios.sys
*** ERROR: Module load completed but symbols could not be loaded for mssmbios.sys
***** Kernel symbols are WRONG. Please fix symbols to do analysis.

*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
Probably caused by : ati2dvag.dll ( ati2dvag+4ad03 )

Followup: MachineOwner
---------

kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

THREAD_STUCK_IN_DEVICE_DRIVER (ea)
The device driver is spinning in an infinite loop, most likely waiting for
hardware to become idle. This usually indicates problem with the hardware
itself or with the device driver programming the hardware incorrectly.
If the kernel debugger is connected and running when watchdog detects a
timeout condition then DbgBreakPoint() will be called instead of KeBugCheckEx()
and detailed message including bugcheck arguments will be printed to the
debugger. This way we can identify an offending thread, set breakpoints in it,
and hit go to return to the spinning code to debug it further. Because
KeBugCheckEx() is not called the .bugcheck directive will not return bugcheck
information in this case. The arguments are already printed out to the kernel
debugger. You can also retrieve them from a global variable via
"dd watchdog!g_WdBugCheckData l5" (use dq on NT64).
On MP machines (OS builds <= 3790) it is possible to hit a timeout when the spinning thread is
interrupted by hardware interrupt and ISR or DPC routine is running at the time
of the bugcheck (this is because the timeout's work item can be delivered and
handled on the second CPU and the same time). If this is the case you will have
to look deeper at the offending thread's stack (e.g. using dds) to determine
spinning code which caused the timeout to occur.
Arguments:
Arg1: 824f6558, Pointer to a stuck thread object. Do .thread then kb on it to find
the hung location.
Arg2: 826cf008, Pointer to a DEFERRED_WATCHDOG object.
Arg3: 826d4218, Pointer to offending driver name.
Arg4: 00000001, Number of times this error occurred. If a debugger is attached,
this error is not always fatal -- see DESCRIPTION below. On the
blue screen, this will always equal 1.

Debugging Details:
------------------

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************

FAULTING_MODULE: 804d8000 nt

DEBUG_FLR_IMAGE_TIMESTAMP: 404e8b7c

FAULTING_THREAD: 824f6558

DEFAULT_BUCKET_ID: WRONG_SYMBOLS

CUSTOMER_CRASH_COUNT: 2

BUGCHECK_STR: 0xEA

LAST_CONTROL_TRANSFER: from 826b9100 to bfa1ed03

STACK_TEXT:
WARNING: Stack unwind information not available. Following frames may be wrong.
eb9eac24 826b9100 bfa0a9b9 eb9eac68 00000000 ati2dvag+0x4ad03
eb9eac28 bfa0a9b9 eb9eac68 00000000 eb9ead10 0x826b9100
eb9eac2c eb9eac68 00000000 eb9ead10 e15b1218 ati2dvag+0x369b9
eb9eac30 00000000 eb9ead10 e15b1218 e15b1001 0xeb9eac68


STACK_COMMAND: .thread 0xffffffff824f6558 ; kb

FOLLOWUP_IP:
ati2dvag+4ad03
bfa1ed03 8b742408 mov esi,dword ptr [esp+8]

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: ati2dvag+4ad03

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: ati2dvag

IMAGE_NAME: ati2dvag.dll

BUCKET_ID: WRONG_SYMBOLS

Followup: MachineOwner