Info:

twitter

Ultimi commenti: Comment feed

Tags:

Sponsor:

Archivio 2018:

Feb Gen

Archivio 2017:

Dic Nov Ott Mag Apr Mar Feb Gen

Archivio 2016:

Dic Nov Ott Ago Mag Mar Feb Gen

Archivio 2015:

Nov Ott Set Mar Gen

Archivio 2014:

Dic Nov Ott Set Lug Giu Mag Apr Gen

Archivio 2013:

Dic Nov Set Ago Lug Giu Mag Apr Feb Gen

Archivio 2012:

Dic Nov Ott Set Ago Giu Mag Apr Mar Feb Gen

Archivio 2011:

Dic Nov Ott Set Ago Lug Giu Mag Apr Mar Feb Gen

Archivio 2010:

Dic Nov Ott Set Ago Lug Giu Mag Apr Mar Feb Gen

Archivio 2009:

Dic Nov Ott Set Ago Lug Giu Mag Apr Mar Feb Gen

Archivio 2008:

Dic Nov Ott Set Ago Lug Giu Mag Apr Mar Feb Gen

Archivio 2007:

Dic Nov Ott Set Ago Lug Giu Mag Apr Mar Feb Gen

Archivio 2006:

Dic Nov Ott Set Ago Lug Giu Mag Apr Mar Feb Gen

Tecniche ‘avanzate’ di BSOD debugging in pseudo-SQL

  1. SET @bigBang = SELECT min(DATE) from BSODs
  2. SET @buggyAppName = SELECT appName FROM Applications WHERE versionUpdateDate= (SELECT MAX(versionUpdateDate) From Applications WHERE versionUpdateDate< @bigBang)
  3. DELETE FROM APPLICATIONS WHERE appName = @buggyAppName
  4. INSERT INTO APPLICATIONS
    (SELECT TOP 1 * FROM INTERNET_OLD_APPLICATIONS WHERE appName = @buggyAppName and versionUpdateDate < @bigBand ORDER BY versionUpdateDate DESC)

In linguaggio umano: usando il reliability monitor annotare la data del primo BSOD misterioso, cercare tra le applicazioni quella che è stata rilasciata più di recente ma prima di tale data, cercare in rete una versione precedente, de-installare-nuova/installare-vecchia.

La tecnica funziona in un buon 90% dei casi dovuti a software, persino quelli più insidiosi come:

BSOD_nuovo

(nel caso specifico l’applicazione fallata era Virtual CloneDrive, a cui sono arrivato tramite la tecnica “superiore” di installazione del debugger Zen e semplicemente osservando il famoso ATAPI.SYS in fondo allo stack)

Buona fortuna

-quack

Potrebbero interessarti anche:
Commenti (34): [ Pagina 1 di 2  - più vecchi ]
5. Snake
mercoledì 20 gennaio 2010 alle 9:28 AM - firefox 3.5.7 Windows 7
   

condizione:  versione = 5.4.4.0

Uhm, ho la 5.4.3.2 su 7 x64 (per fortuna fin'ora nessuna bsod)

   
6. Giuseppe
mercoledì 20 gennaio 2010 alle 9:36 AM - IE 8.0 Windows 7
   

@ Snake

Anche io ho quella versione... nessun problema su 7 x86

   
7. floo
mercoledì 20 gennaio 2010 alle 1:06 PM - firefox 3.6 Windows 7
   

Beeeeeeello, allora esistono ancora quelle schermate blu!

Io è da aprile 2008 che non ne vedo più una

(Niente VirtualCloneDrive, era un commento giusto per cazzeggio )

   
8. dovella
mercoledì 20 gennaio 2010 alle 1:12 PM - chrome 3.0.195.38 Windows 7
   

io l ultimo Bsod l ho avuto con Vista (non c era manco SP1)  installando uno stravecchissimo titolo Jap .

E grattaondomi , spero di andare  avanti per questa strada

   
9. floo
mercoledì 20 gennaio 2010 alle 1:16 PM - firefox 3.6 Windows 7
   

Io con Vista SP1, a causa di ZoneAlarm che ancora non era compatibile.

Mi ricordo le bestemmie rivolte verso il povero Vista, che dopo una ricerca su Internet ho trovato incolpevole (da lì ho smesso di prendermela subito con l'OS, ma di cercare se sono altre le cause dei problemi )

Tolto ZoneAlarm, messo Comodo e sono tornato tranquillo

Da 7, invece, uso Windows Firewall e mi trovo piuttosto bene

   
10. dovella
mercoledì 20 gennaio 2010 alle 4:30 PM - chrome 3.0.195.38 Windows 7
   

Appena verificata

 

5.4.3.2

   
11. Daniele
giovedì 21 gennaio 2010 alle 11:46 AM - firefox 3.6 Windows XP
   

Io ho ancora la 5.4.3.5

   
12. lzk87
giovedì 21 gennaio 2010 alle 12:30 PM - IE 8.0 Windows 7
   

blue screen fresco di stamane.. chi me lo spiega? stavo navigando normalmente con IE 8 ...

Firma problema:
  Nome evento problema: BlueScreen
  Versione SO: 6.1.7600.2.0.0.768.3
  ID impostazioni locali: 1040

Ulteriori informazioni sul problema:
  BCCode: 124
  BCP1: 0000000000000000
  BCP2: FFFFFA8005112038
  BCP3: 0000000000000000
  BCP4: 0000000000000000
  OS Version: 6_1_7600
  Service Pack: 0_0
  Product: 768_1

File che contribuiscono alla descrizione del problema:
  C:\Windows\Minidump\012110-15553-01.dmp
  C:\Users\lzk87\AppData\Local\Temp\WER-22526-0.sysdata.xml

Leggere l'informativa sulla privacy online:
  http://go.microsoft.com/fwlink/?...

Se l'informativa sulla privacy online non è disponibile, leggere quella offline:
  C:\Windows\system32\it-IT\erofflps.txt

   
13. Snake
giovedì 21 gennaio 2010 alle 12:45 PM - firefox 3.5.7 Windows 7
   

  C:\Windows\Minidump\012110-15553-01.dmp

Servirebbe analizzare il suddetto con WinDBG per risalire alla causa.

   
14. lzk87
giovedì 21 gennaio 2010 alle 12:57 PM - IE 8.0 Windows 7
   

vedo se riesco ad aprirlo con qualcosa... suggerimenti??

   
15. Snake
giovedì 21 gennaio 2010 alle 12:59 PM - firefox 3.5.7 Windows 7
   

suggerimenti

WinDBG

   
16. lzk87
giovedì 21 gennaio 2010 alle 1:08 PM - IE 8.0 Windows 7
   

Blue screen view mi riporta questo ora provo WinDBG

 

File di Dump Data e Ora del Crash Bug Check String Bug Check Code Parametro 1 Parametro 2 Parametro 3 Parametro 4 Causato Da Driver Causato Da Indirizzo Descrizione del File Nome del Prodotto Società Versione del File Processore Computer Name Full Path Processors Count Major Version Minor Version 012110-15553-01.dmp21/01/2010 07:37:04 0x0000012400000000`00000000fffffa80`0511203800000000`0000000000000000`00000000ntoskrnl.exentoskrnl.exe+4a63ccNT Kernel & SystemMicrosoft® Windows® Operating SystemMicrosoft Corporation6.1.7600.16385 (win7_rtm.090713-1255)x64 C:\Windows\minidump\012110-15553-01.dmp4157600
   
17. lzk87
giovedì 21 gennaio 2010 alle 1:08 PM - IE 8.0 Windows 7
   

un gran bel casino col copia incolla.. scusa paperino rimuovi pure

   
18. floo
giovedì 21 gennaio 2010 alle 1:17 PM - firefox 3.6 Windows 7
   

Donald, we have a bug

   
19. lzk87
giovedì 21 gennaio 2010 alle 1:33 PM - IE 8.0 Windows 7
   

winDBG mi da una serie di caratteri incomprensibili, sicuri che serva anche per i dump del bluescreen?  voglio capire se è un crash dei beta driver di ATI, Creative, o qualcosa d'altro

   
20. Snake
giovedì 21 gennaio 2010 alle 1:43 PM - firefox 3.5.7 Windows 7
   

Sì, assolutamente. Caricalo da qualche parte (skydrive, mediafire etc) che gli si da un'occhiata

   
21. il nonno
giovedì 21 gennaio 2010 alle 1:44 PM - IE 8.0 Windows 7
   

@lzk87

certo che WinDbg serve per aprire i minidump, vai sul menu' File e seleziona "Open Crash Dump..." ma devi prima settare il path per i simboli se vuoi una diagnosi precisa.

   
22. lzk87
giovedì 21 gennaio 2010 alle 3:03 PM - IE 8.0 Windows 7
   

ciao raga grazie per gli aiuti, intanto ho visto questo:

(abbiate pazienza, non capisco dove pescare i simboli)

(quel Probably caused by : hardware che vedo in fondo è la diagnosi per noi umani?)


Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Levi\Desktop\012110-15553-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: *** Invalid ***
****************************************************************************
* Symbol loading may be unreliable without a symbol search path.           *
* Use .symfix to have the debugger choose a symbol path.                   *
* After setting your symbol path, use .reload to refresh symbol locations. *
****************************************************************************
Executable search path is:
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
*                                                                   *
* The Symbol Path can be set by:                                    *
*   using the _NT_SYMBOL_PATH environment variable.                 *
*   using the -y <symbol_path> argument when starting the debugger. *
*   using .sympath and .sympath+                                    *
*********************************************************************
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Machine Name:
Kernel base = 0xfffff800`02c06000 PsLoadedModuleList = 0xfffff800`02e43e50
Debug session time: Thu Jan 21 07:36:59.286 2010 (GMT+1)
System Uptime: 0 days 0:00:08.377
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
*                                                                   *
* The Symbol Path can be set by:                                    *
*   using the _NT_SYMBOL_PATH environment variable.                 *
*   using the -y <symbol_path> argument when starting the debugger. *
*   using .sympath and .sympath+                                    *
*********************************************************************
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Loading Kernel Symbols
...............................................
Loading User Symbols
Mini Kernel Dump does not contain unloaded driver list
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 124, {0, fffffa8005112038, 0, 0}

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_WHEA_ERROR_RECORD_HEADER                  ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_WHEA_ERROR_RECORD_HEADER                  ***
***                                                                   ***
*************************************************************************
Unable to load image PSHED.dll, Win32 error 0n2
*** WARNING: Unable to verify timestamp for PSHED.dll
*** ERROR: Module load completed but symbols could not be loaded for PSHED.dll
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: pshed!_WHEA_ERROR_RECORD_HEADER                ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: pshed!_WHEA_ERROR_RECORD_SECTION_DESCRIPTOR                ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: pshed!_WHEA_ERROR_RECORD_HEADER                ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: pshed!_WHEA_ERROR_RECORD_HEADER                ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: pshed!_WHEA_ERROR_RECORD_HEADER                ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_KPRCB                                     ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_KPRCB                                     ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_KPRCB                                     ***
***                                                                   ***
*************************************************************************
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
*                                                                   *
* The Symbol Path can be set by:                                    *
*   using the _NT_SYMBOL_PATH environment variable.                 *
*   using the -y <symbol_path> argument when starting the debugger. *
*   using .sympath and .sympath+                                    *
*********************************************************************
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
*                                                                   *
* The Symbol Path can be set by:                                    *
*   using the _NT_SYMBOL_PATH environment variable.                 *
*   using the -y <symbol_path> argument when starting the debugger. *
*   using .sympath and .sympath+                                    *
*********************************************************************
Probably caused by : hardware

Followup: MachineOwner
---------

   
23. lzk87
giovedì 21 gennaio 2010 alle 3:06 PM - IE 8.0 Windows 7
   

@snake: se proprio vuoi vederlo
Grazie di tutto a tutti ovviamente

http://www.megaupload.com/?d=5939SXAW

   
24. Paperino
giovedì 21 gennaio 2010 alle 6:17 PM - firefox 3.5.7 Windows 7
   

@lzk87:

È una Machine Check Exception

Hai overcloccato?

   
25. lzk87
giovedì 21 gennaio 2010 alle 8:59 PM - IE 8.0 Windows 7
   

no, overcloccato tipo 7 mesi fa ma roba leggerissima.. poi ho lasciato tutto a default .... mmmmm saranno i driver beta che sto provando può essere??

   
26. Paperino
giovedì 21 gennaio 2010 alle 9:01 PM - firefox 3.6 Windows 7
   

Hardware Fault -> i driver non c'entrano.

   
27. lzk87
giovedì 21 gennaio 2010 alle 10:13 PM - IE 8.0 Windows 7
   

andiamo bene l'altro giorno ho fatto un memtest ed era perfetto, dovro vedere gli altri componenti come stanno, grazie mille!!

   
28. Snake
giovedì 21 gennaio 2010 alle 10:25 PM - firefox 3.5.7 Windows 7
   

dissipatore ko? (pasta termica secca/di scarsa qualità/insufficiente oppure pessimo ricircolo dell'aria/ostruzione delle laminature e della ventola che causano surriscaldamento)

   
29. lzk87
giovedì 21 gennaio 2010 alle 10:58 PM - IE 8.0 Windows 7
   

in effetti son 3 mesi che non apro il PC per fare manutenzione domani ci do un occhiatina

   
30. Edward
venerdì 22 gennaio 2010 alle 6:43 PM - firefox 3.5.7 Windows 7
   

@ lzk87:

L'alimentatore e' di buona qualita' (leggi: niente cineserie da 20 euro o "regalate" assieme al case)?

 

Edward

   
31. Giuseppe
venerdì 22 gennaio 2010 alle 6:50 PM - IE 8.0 Windows 7
   

@Edward, Snake

La cosa più probabile (postai in off-Topo un po' di tempo fa) è la polvere... a me si era incrostata letteralmente nei dissipatori della CPU: ho un sistema di raffreddamento che è fatto dal processore su cui è poggiato una specie di "stella metallica a 100 punte e sopra di essa una ventola, ebbene la polvere era incrostata tra le "punte" del dissipatore metallico una roba allucinante... se hai il "Folletto" ti consiglio una pulizia con quello lì, ovviamente dotato di "estensione computer" (un riduttore di flusso fatto apposta x i componenti elettronici) oppure con fazzoletti, phon e tanta buona volontà (in un paio d'ore dovresti risolvere...

   
32. Giuseppe
venerdì 22 gennaio 2010 alle 6:51 PM - IE 8.0 Windows 7
   

@ snake

mi rendo conto che

ostruzione delle laminature e della ventola che causano surriscaldamento

è il modo "figo" (nonchè esatto) di dire quello che ho detto io

 

   
33. Snake
venerdì 22 gennaio 2010 alle 8:22 PM - firefox 3.6 Windows 7
   

@Giuseppe, lol, deformazione professionale

   
34. lzk87
sabato 23 gennaio 2010 alle 1:34 PM - IE 8.0 Windows 7
   

ho pulito ben bene circa 200 grammi di polvere erano 4 mesi che non aprivo il case per ora  è tutto fresco (ci credo in questa stagione) e ok

   
[ Pagina 1 di 2  - più vecchi ]
Lascia un commento:
Commento: (clicca su questo link per gli smiley supportati; regole di ingaggio per i commenti)
(opzionale, per il Gravatar)