[LOGICIEL] Le choix des symbols pour WINDBG

[baron sengir]

Bonjour à tous,

Voilà ayant un petit souci avec ces fameux BSOD (Bleu Screen Of the Death) créé je pense par un logiciel que j'avais mis (OO defrag v8.0), j'ai lu cet article très bien fait d'ailleur et voulu savoir si ca venai bien de ce log

( L'ARTICLE DE WINDBG) :

http://www.laboratoire-microsoft.org/articles/teched_2002/4/

donc telechargement de windbg, install, telechergement sur microsoft du pack (symbol xp sp2 x86 retail) qui je pense correspond bien (j'espere) car je n'ai pas pu telecharger ce pack via windbg pour cause que l'adresse n'est plus valable cette fameuse INSTRUCTION A RENTRER DANS WINDBG=>srv*c:\symbols*http://msdl.microsoft.com/download/symbols s

le hic c'est que j'ai fais l'analyse de mon dernier fichier dump dont voici le rapport (dsl pour la longueur)

Microsoft ® Windows Debugger Version 6.6.0007.5

Copyright © Microsoft Corporation. All rights reserved.

Loading Dump File [C:\WINDOWS\Minidump\Mini101606-08.dmp]

Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: *** Invalid ***

****************************************************************************

* Symbol loading may be unreliable without a symbol search path. *

* Use .symfix to have the debugger choose a symbol path. *

* After setting your symbol path, use .reload to refresh symbol locations. *

****************************************************************************

Executable search path is:

*********************************************************************

* Symbols can not be loaded because symbol path is not initialized. *

* *

* The Symbol Path can be set by: *

* using the _NT_SYMBOL_PATH environment variable. *

* using the -y <symbol_path> argument when starting the debugger. *

* using .sympath and .sympath+ *

*********************************************************************

Unable to load image ntoskrnl.exe, Win32 error 2

*** WARNING: Unable to verify timestamp for ntoskrnl.exe

*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe

Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible

Product: WinNt, suite: TerminalServer SingleUserTS Personal

Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055a420

Debug session time: Mon Oct 16 20:29:04.109 2006 (GMT+2)

System Uptime: 0 days 0:20:05.683

*********************************************************************

* Symbols can not be loaded because symbol path is not initialized. *

* *

* The Symbol Path can be set by: *

* using the _NT_SYMBOL_PATH environment variable. *

* using the -y <symbol_path> argument when starting the debugger. *

* using .sympath and .sympath+ *

*********************************************************************

Unable to load image ntoskrnl.exe, Win32 error 2

*** WARNING: Unable to verify timestamp for ntoskrnl.exe

*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe

Loading Kernel Symbols

....................................................................................................................

Loading User Symbols

Loading unloaded module list

...................................

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000008E, {c0000005, 8057d9fb, b93cdb04, 0}

ANALYSIS: Kernel with unknown size. Will force reload symbols with known size.

ANALYSIS: Force reload command: .reload /f ntoskrnl.exe=FFFFFFFF804D7000,213F80,42250FF9

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

*** WARNING: Unable to verify timestamp for filespy.sys

*** ERROR: Module load completed but symbols could not be loaded for filespy.sys

*** WARNING: Unable to verify timestamp for regspy.sys

*** ERROR: Module load completed but symbols could not be loaded for regspy.sys

Probably caused by : filespy.sys ( filespy+18aa )

Followup: MachineOwner

------------------

LE PROBLEME je pense que mon pack symbol n'est pas le bon (car il marque ERROR ect...). J'ai télécharger le premier pack intiltulé: windows xp service pack 2 retail symbol, all languages à ce lien : (http://www.microsoft.com/whdc/devtools/debugging/symbolpkg.mspx)

Mes questions :

1) comment savoir le bon pack qu'il me faut??????

2) quelles sont les differences entres ces 2 pack : - Windows XP with Service Pack 2 symbols

- Reduced download size: Windows XP Service Pack 2

3) que pensez vous du rapport de windbg?

MERCI pour vos avis et conseils