WinDbg'da dx komutu nasıl kullanılır?

EmirhanKod

Hectopat
Katılım
5 Temmuz 2020
Mesajlar
717
Makaleler
1
Çözümler
5
Örnek bir minidump dosyası buldum. Bunun hatası DRIVER_IRQL_NOT_LESS_OR_EQUAL idi.

Buradan da bakarken dx komutunu kullanın diyordu. Bende dx komutunu araştırmaya başladım ama anlamadığım kısımlar var. Konuyu çok uzatmayayım bana anlatabilir misiniz dx komutunun işlevini ve ne zaman kullancağımızı?
Kendimi geliştirmek istediğim için bu soruyu soruyorum.
Teşekkür ederim.



Kod:
DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 00000000ccb58294, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, value 0 = read operation, 1 = write operation
Arg4: fffff8008643f780, address which referenced memory

Debugging Details:
------------------

*** WARNING: Unable to verify checksum for win32k.sys

KEY_VALUES_STRING: 1

Key : Analysis.CPU.mSec
Value: 6812

Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on DESKTOP-I3EKBK0

Key : Analysis.DebugData
Value: CreateObject

Key : Analysis.DebugModel
Value: CreateObject

Key : Analysis.Elapsed.mSec
Value: 32258

Key : Analysis.Memory.CommitPeak.Mb
Value: 81

Key : Analysis.System
Value: CreateObject

Key : WER.OS.Branch
Value: 19h1_release

Key : WER.OS.Timestamp
Value: 2019-03-18T12:02:00Z

Key : WER.OS.Version
Value: 10.0.18362.1


ADDITIONAL_XML: 1

OS_BUILD_LAYERS: 1

BUGCHECK_CODE: d1

BUGCHECK_P1: ccb58294

BUGCHECK_P2: 2

BUGCHECK_P3: 0

BUGCHECK_P4: fffff8008643f780

READ_ADDRESS: fffff8007f3733b8: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
fffff8007f22a3c8: Unable to get Flags value from nt!KdVersionBlock
fffff8007f22a3c8: Unable to get Flags value from nt!KdVersionBlock
unable to get nt!MmSpecialPagesInUse
00000000ccb58294

BLACKBOXBSD: 1 (!blackboxbsd)


BLACKBOXNTFS: 1 (!blackboxntfs)


BLACKBOXPNP: 1 (!blackboxpnp)


BLACKBOXWINLOGON: 1

CUSTOMER_CRASH_COUNT: 1

PROCESS_NAME: System

TRAP_FRAME:  fffff48f31cbfa20 -- (.trap 0xfffff48f31cbfa20)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=ffffbb8bccb55000
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8008643f780 rsp=fffff48f31cbfbb0 rbp=fffff48f31cbfcb0
r8=00000000ccb58294 r9=0000000000000d61 r10=00000000000025aa
r11=0000000000000001 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na pe nc
nvlddmkm+0x82f780:
fffff800`8643f780 418b00 mov eax,dword ptr [r8] ds:00000000`ccb58294=????????
Resetting default scope

STACK_TEXT:
fffff48f`31cbf8d8 fffff800`7efd32e9 : 00000000`0000000a 00000000`ccb58294 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff48f`31cbf8e0 fffff800`7efcf62b : ffffbb8b`d7c5d010 ffffbb8b`ccb55000 fffff48f`31cbfb00 fffff800`863d0e4c : nt!KiBugCheckDispatch+0x69
fffff48f`31cbfa20 fffff800`8643f780 : ffffbb8b`d7c5d178 fffff48f`31cbfcb0 ffffbb8b`cda03000 ffffbb8b`d658a008 : nt!KiPageFault+0x46b
fffff48f`31cbfbb0 ffffbb8b`d7c5d178 : fffff48f`31cbfcb0 ffffbb8b`cda03000 ffffbb8b`d658a008 ffffbb8b`d90e7b60 : nvlddmkm+0x82f780
fffff48f`31cbfbb8 fffff48f`31cbfcb0 : ffffbb8b`cda03000 ffffbb8b`d658a008 ffffbb8b`d90e7b60 ffffbb8b`cd9e1c6c : 0xffffbb8b`d7c5d178
fffff48f`31cbfbc0 ffffbb8b`cda03000 : ffffbb8b`d658a008 ffffbb8b`d90e7b60 ffffbb8b`cd9e1c6c ffffbb8b`cd9e1c74 : 0xfffff48f`31cbfcb0
fffff48f`31cbfbc8 ffffbb8b`d658a008 : ffffbb8b`d90e7b60 ffffbb8b`cd9e1c6c ffffbb8b`cd9e1c74 ffff0100`00000000 : 0xffffbb8b`cda03000
fffff48f`31cbfbd0 ffffbb8b`d90e7b60 : ffffbb8b`cd9e1c6c ffffbb8b`cd9e1c74 ffff0100`00000000 fffff800`00000000 : 0xffffbb8b`d658a008
fffff48f`31cbfbd8 ffffbb8b`cd9e1c6c : ffffbb8b`cd9e1c74 ffff0100`00000000 fffff800`00000000 00000000`083600a0 : 0xffffbb8b`d90e7b60
fffff48f`31cbfbe0 ffffbb8b`cd9e1c74 : ffff0100`00000000 fffff800`00000000 00000000`083600a0 00000000`00010101 : 0xffffbb8b`cd9e1c6c
fffff48f`31cbfbe8 ffff0100`00000000 : fffff800`00000000 00000000`083600a0 00000000`00010101 fffff48f`31cc0810 : 0xffffbb8b`cd9e1c74
fffff48f`31cbfbf0 fffff800`00000000 : 00000000`083600a0 00000000`00010101 fffff48f`31cc0810 ffffbb8b`da502050 : 0xffff0100`00000000
fffff48f`31cbfbf8 00000000`083600a0 : 00000000`00010101 fffff48f`31cc0810 ffffbb8b`da502050 00000000`00000000 : 0xfffff800`00000000
fffff48f`31cbfc00 00000000`00010101 : fffff48f`31cc0810 ffffbb8b`da502050 00000000`00000000 ffffbb8b`ccb55000 : 0x83600a0
fffff48f`31cbfc08 fffff48f`31cc0810 : ffffbb8b`da502050 00000000`00000000 ffffbb8b`ccb55000 ffffbb8b`cda03000 : 0x10101
fffff48f`31cbfc10 ffffbb8b`da502050 : 00000000`00000000 ffffbb8b`ccb55000 ffffbb8b`cda03000 00000000`0017d5ff : 0xfffff48f`31cc0810
fffff48f`31cbfc18 00000000`00000000 : ffffbb8b`ccb55000 ffffbb8b`cda03000 00000000`0017d5ff 00000100`00000000 : 0xffffbb8b`da502050


SYMBOL_NAME: nvlddmkm+82f780

MODULE_NAME: nvlddmkm

IMAGE_NAME:  nvlddmkm.sys

STACK_COMMAND: .thread ; .cxr ; kb

BUCKET_ID_FUNC_OFFSET: 82f780

FAILURE_BUCKET_ID: AV_nvlddmkm!unknown_function

OS_VERSION: 10.0.18362.1

BUILDLAB_STR: 19h1_release

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

FAILURE_ID_HASH: {7eea5677-f68d-2154-717e-887e07e55cd3}

Followup: MachineOwner
---------
 
Son düzenleyen: Moderatör:

Geri
Yukarı