[Windbg] Windows 7 遇到 BAD_SYSTEM_CONFIG_INFO (74) 的 BSOD
今天同事回報，專案的機器斷續出現了數次 BSOD (藍色死亡螢幕)，
手上只有一個 Mini Dump，就先用 Windbg 來瞧瞧：
kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* BAD_SYSTEM_CONFIG_INFO (74) Can indicate that the SYSTEM hive loaded by the osloader/NTLDR was corrupt. This is unlikely, since the osloader will check a hive to make sure it isn't corrupt after loading it. It can also indicate that some critical registry keys and values are not present. (i.e. somebody used regedt32 to delete something that they shouldn't have) Booting from LastKnownGood may fix the problem, but if someone is persistent enough in mucking with the registry they will need to reinstall or use the Emergency Repair Disk. Arguments: Arg1: 00000002, (reserved) Arg2: 80de0aa8, (reserved) Arg3: 00000002, (reserved) Arg4: c000014c, usually the NT status code. Debugging Details: ------------------ DUMP_CLASS: 1 DUMP_QUALIFIER: 400 BUILD_VERSION_STRING: 7601.17514.x86fre.win7sp1_rtm.101119-1850 SYSTEM_MANUFACTURER: innotek GmbH VIRTUAL_MACHINE: VirtualBox SYSTEM_PRODUCT_NAME: VirtualBox SYSTEM_VERSION: 1.2 BIOS_VENDOR: innotek GmbH BIOS_VERSION: VirtualBox BIOS_DATE: 12/01/2006 BASEBOARD_MANUFACTURER: Oracle Corporation BASEBOARD_PRODUCT: VirtualBox BASEBOARD_VERSION: 1.2 DUMP_TYPE: 2 BUGCHECK_P1: 2 BUGCHECK_P2: ffffffff80de0aa8 BUGCHECK_P3: 2 BUGCHECK_P4: ffffffffc000014c CPU_COUNT: 1 CPU_MHZ: 898 CPU_VENDOR: GenuineIntel CPU_FAMILY: 6 CPU_MODEL: 3e CPU_STEPPING: 4 CPU_MICROCODE: 6,3e,4,0 (F,M,S,R) SIG: 19'00000000 (cache) 19'00000000 (init) CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT BUGCHECK_STR: 0x74 PROCESS_NAME: System CURRENT_IRQL: 0 ANALYSIS_SESSION_TIME: 07-19-2016 00:12:29.0497 ANALYSIS_VERSION: 10.0.10586.567 amd64fre LAST_CONTROL_TRANSFER: from 829dd75d to 82927428 STACK_TEXT: 80de0a3c 829dd75d 00000074 00000002 80de0aa8 nt!KeBugCheckEx+0x1e 80de0c50 82a3e400 00000002 97f3a7bd 00000000 nt!CmpLoadHiveThread+0x1d5 80de0c90 828de969 829dd588 00000002 00000000 nt!PspSystemThreadStartup+0x9e 00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x19 STACK_COMMAND: kb THREAD_SHA1_HASH_MOD_FUNC: 0923d9a023698d301c5cb0a37750d4865823449c THREAD_SHA1_HASH_MOD_FUNC_OFFSET: 75cf9f942485e99c274e32a479046970d353e367 THREAD_SHA1_HASH_MOD: d084f7dfa548ce4e51810e4fd5914176ebc66791 FOLLOWUP_IP: nt!CmpLoadHiveThread+1d5 829dd75d cc int 3 FAULT_INSTR_CODE: 5846f7cc SYMBOL_STACK_INDEX: 1 SYMBOL_NAME: nt!CmpLoadHiveThread+1d5 FOLLOWUP_NAME: MachineOwner MODULE_NAME: nt IMAGE_NAME: ntkrnlmp.exe DEBUG_FLR_IMAGE_TIMESTAMP: 4ce78a06 IMAGE_VERSION: 6.1.7601.17514 FAILURE_BUCKET_ID: 0x74_nt!CmpLoadHiveThread+1d5 BUCKET_ID: 0x74_nt!CmpLoadHiveThread+1d5 PRIMARY_PROBLEM_CLASS: 0x74_nt!CmpLoadHiveThread+1d5 TARGET_TIME: 2016-07-18T17:44:52.000Z OSBUILD: 7601 OSSERVICEPACK: 1000 SERVICEPACK_NUMBER: 0 OS_REVISION: 0 SUITE_MASK: 272 PRODUCT_TYPE: 1 OSPLATFORM_TYPE: x86 OSNAME: Windows 7 OSEDITION: Windows 7 WinNt (Service Pack 1) TerminalServer SingleUserTS OS_LOCALE: USER_LCID: 0 OSBUILD_TIMESTAMP: 2010-11-20 16:42:46 BUILDDATESTAMP_STR: 101119-1850 BUILDLAB_STR: win7sp1_rtm BUILDOSVER_STR: 6.1.7601.17514.x86fre.win7sp1_rtm.101119-1850 ANALYSIS_SESSION_ELAPSED_TIME: 32c ANALYSIS_SOURCE: KM FAILURE_ID_HASH_STRING: km:0x74_nt!cmploadhivethread+1d5 FAILURE_ID_HASH: {fd769186-fc25-f32f-6b5e-482763a1f51d} Followup: MachineOwner ---------
這個 core dump 的 Bug Check Code (BCC) 是 BAD_SYSTEM_CONFIG_INFO (74)，
死的地方是 nt!CmpLoadHiveThread，不過資訊並不多…
上網查了一下，倒是有不少跟 CmpLoadHiveThread 有關的 BSOD 案例：
Windows 7 Blue Screen Error 0xF4: wfplwf.sys and ntoskrnl.exe issues
Windows 7 0x00000074 startup Blue Screen BAD_SYSTEM_CONFIG_INFO Different problem than all others
Sometimes I get a blue screen when using Ie 8
Fatal Error Solutions: BAD_SYSTEM_CONFIG_INFO STOP: 0x00000074
歸納這些文章裡提到的可能當機原因：
– CPU 超頻 (overclocking)
– 記憶體損壞
– 登錄值 (registry key) 缺少或損壞
可能修復的方法有：
– 開機時選擇修復選項
– 回到舊的 (好的) 系統還原點
– 執行 sfc /scannow
– 執行 chkdsk
– 取消 bcdedit 中關於 CPU 數目與最大記憶體的限制
bcdedit/deletevalue {default} numproc bcdedit/deletevalue {default} truncatememory
文章中也有人推薦兩個工具，BlueScreenView 和 MyEventViewer～
BlueScreenView 可以用來載入一個指定的 crash dump (或是 Windows 目錄中的 crash dump)，
然後秀出相關的資訊，像在本例中多顯示了 CLASSPNP.SYS 有出現在當機時的 stack 裡
(不過 windbg 並沒有顯示)
MyEventViewer 可以用來看當機時，系統是否有記錄相關的訊息，
這可能也可以提供一些線索…
(本頁面已被瀏覽過 1,169 次)