[Windbg] Windows 7 遇到 BAD_SYSTEM_CONFIG_INFO (74) 的 BSOD

[Windbg] Windows 7 遇到 BAD_SYSTEM_CONFIG_INFO (74) 的 BSOD

今天同事回報,專案的機器斷續出現了數次 BSOD (藍色死亡螢幕),

手上只有一個 Mini Dump,就先用 Windbg 來瞧瞧:

kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************
BAD_SYSTEM_CONFIG_INFO (74)
Can indicate that the SYSTEM hive loaded by the osloader/NTLDR
was corrupt.  This is unlikely, since the osloader will check
a hive to make sure it isn't corrupt after loading it.
It can also indicate that some critical registry keys and values
are not present.  (i.e. somebody used regedt32 to delete something
that they shouldn't have)  Booting from LastKnownGood may fix
the problem, but if someone is persistent enough in mucking with
the registry they will need to reinstall or use the Emergency
Repair Disk.
Arguments:
Arg1: 00000002, (reserved)
Arg2: 80de0aa8, (reserved)
Arg3: 00000002, (reserved)
Arg4: c000014c, usually the NT status code.
Debugging Details:
------------------
DUMP_CLASS: 1
DUMP_QUALIFIER: 400
BUILD_VERSION_STRING:  7601.17514.x86fre.win7sp1_rtm.101119-1850
SYSTEM_MANUFACTURER:  innotek GmbH
VIRTUAL_MACHINE:  VirtualBox
SYSTEM_PRODUCT_NAME:  VirtualBox
SYSTEM_VERSION:  1.2
BIOS_VENDOR:  innotek GmbH
BIOS_VERSION:  VirtualBox
BIOS_DATE:  12/01/2006
BASEBOARD_MANUFACTURER:  Oracle Corporation
BASEBOARD_PRODUCT:  VirtualBox
BASEBOARD_VERSION:  1.2
DUMP_TYPE:  2
BUGCHECK_P1: 2
BUGCHECK_P2: ffffffff80de0aa8
BUGCHECK_P3: 2
BUGCHECK_P4: ffffffffc000014c
CPU_COUNT: 1
CPU_MHZ: 898
CPU_VENDOR:  GenuineIntel
CPU_FAMILY: 6
CPU_MODEL: 3e
CPU_STEPPING: 4
CPU_MICROCODE: 6,3e,4,0 (F,M,S,R)  SIG: 19'00000000 (cache) 19'00000000 (init)
CUSTOMER_CRASH_COUNT:  1
DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT
BUGCHECK_STR:  0x74
PROCESS_NAME:  System
CURRENT_IRQL:  0
ANALYSIS_SESSION_TIME:  07-19-2016 00:12:29.0497
ANALYSIS_VERSION: 10.0.10586.567 amd64fre
LAST_CONTROL_TRANSFER:  from 829dd75d to 82927428
STACK_TEXT:
80de0a3c 829dd75d 00000074 00000002 80de0aa8 nt!KeBugCheckEx+0x1e
80de0c50 82a3e400 00000002 97f3a7bd 00000000 nt!CmpLoadHiveThread+0x1d5
80de0c90 828de969 829dd588 00000002 00000000 nt!PspSystemThreadStartup+0x9e
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x19
STACK_COMMAND:  kb
THREAD_SHA1_HASH_MOD_FUNC:  0923d9a023698d301c5cb0a37750d4865823449c
THREAD_SHA1_HASH_MOD_FUNC_OFFSET:  75cf9f942485e99c274e32a479046970d353e367
THREAD_SHA1_HASH_MOD:  d084f7dfa548ce4e51810e4fd5914176ebc66791
FOLLOWUP_IP:
nt!CmpLoadHiveThread+1d5
829dd75d cc              int     3
FAULT_INSTR_CODE:  5846f7cc
SYMBOL_STACK_INDEX:  1
SYMBOL_NAME:  nt!CmpLoadHiveThread+1d5
FOLLOWUP_NAME:  MachineOwner
MODULE_NAME: nt
IMAGE_NAME:  ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP:  4ce78a06
IMAGE_VERSION:  6.1.7601.17514
FAILURE_BUCKET_ID:  0x74_nt!CmpLoadHiveThread+1d5
BUCKET_ID:  0x74_nt!CmpLoadHiveThread+1d5
PRIMARY_PROBLEM_CLASS:  0x74_nt!CmpLoadHiveThread+1d5
TARGET_TIME:  2016-07-18T17:44:52.000Z
OSBUILD:  7601
OSSERVICEPACK:  1000
SERVICEPACK_NUMBER: 0
OS_REVISION: 0
SUITE_MASK:  272
PRODUCT_TYPE:  1
OSPLATFORM_TYPE:  x86
OSNAME:  Windows 7
OSEDITION:  Windows 7 WinNt (Service Pack 1) TerminalServer SingleUserTS
OS_LOCALE:
USER_LCID:  0
OSBUILD_TIMESTAMP:  2010-11-20 16:42:46
BUILDDATESTAMP_STR:  101119-1850
BUILDLAB_STR:  win7sp1_rtm
BUILDOSVER_STR:  6.1.7601.17514.x86fre.win7sp1_rtm.101119-1850
ANALYSIS_SESSION_ELAPSED_TIME: 32c
ANALYSIS_SOURCE:  KM
FAILURE_ID_HASH_STRING:  km:0x74_nt!cmploadhivethread+1d5
FAILURE_ID_HASH:  {fd769186-fc25-f32f-6b5e-482763a1f51d}
Followup:     MachineOwner
---------

 

這個 core dump 的 Bug Check Code (BCC) 是 BAD_SYSTEM_CONFIG_INFO (74),

死的地方是 nt!CmpLoadHiveThread,不過資訊並不多…

上網查了一下,倒是有不少跟 CmpLoadHiveThread 有關的 BSOD 案例:

Windows 7 Blue Screen Error 0xF4: wfplwf.sys and ntoskrnl.exe issues

Windows 7 0x00000074 startup Blue Screen BAD_SYSTEM_CONFIG_INFO Different problem than all others

Sometimes I get a blue screen when using Ie 8

Fatal Error Solutions: BAD_SYSTEM_CONFIG_INFO STOP: 0x00000074

 

歸納這些文章裡提到的可能當機原因:

  – CPU 超頻 (overclocking)

  – 記憶體損壞

  – 登錄值 (registry key) 缺少或損壞

 

可能修復的方法有:

  – 開機時選擇修復選項

  – 回到舊的 (好的) 系統還原點

  – 執行 sfc /scannow

  – 執行 chkdsk

  – 取消 bcdedit 中關於 CPU 數目與最大記憶體的限制 

bcdedit/deletevalue {default} numproc
bcdedit/deletevalue {default} truncatememory

 

文章中也有人推薦兩個工具,BlueScreenViewMyEventViewer

BlueScreenView 可以用來載入一個指定的 crash dump (或是 Windows 目錄中的 crash dump),

然後秀出相關的資訊,像在本例中多顯示了 CLASSPNP.SYS 有出現在當機時的 stack 裡

(不過 windbg 並沒有顯示)

20160719_004303  

 

MyEventViewer 可以用來看當機時,系統是否有記錄相關的訊息,

這可能也可以提供一些線索…

 

(本頁面已被瀏覽過 580 次)

發佈留言

發佈留言必須填寫的電子郵件地址不會公開。

這個網站採用 Akismet 服務減少垃圾留言。進一步瞭解 Akismet 如何處理網站訪客的留言資料