Yousuf Khan
2010-01-10 21:49:21 UTC
I've been attempting to get to the bottom of a recurring BSOD crash
happening on my system. I've already had 4 crashes so far over the past
two weeks. So I've identified that NTOSKRNL.EXE is involved in all of
them so far. It always somewhere in the stack. So I enabled Driver
Verifier on NTOSKRNL, as well as HAL.DLL, NTFS.SYS, and FLTMGR.SYS which
were also identified on the stack during various of the events.
Okay so I had my latest crash yesterday, and it occurred on NTOSKRNL as
well. The Verifier was already enabled on the system prior to this
crash, and then when go to Windbg and execute the "!verifier" command,
it comes back with the message, "Unable to get verifier list". Why not,
it should be enabled?
When I check them on the command-prompt I get the following output back,
and they confirm that all of the files are being monitored. So can
somebody familiar with Driver Verifier and Windbg help me out here?
Yousuf Khan
***
Level: 0000009B
RaiseIrqls: 314843045
AcquireSpinLocks: 1893615496
SynchronizeExecutions: 0
AllocationsAttempted: 90514901
AllocationsSucceeded: 90514901
AllocationsSucceededSpecialPool: 7614086
AllocationsWithNoTag: 0
AllocationsFailed: 0
AllocationsFailedDeliberately: 0
Trims: 2452146
UnTrackedPool: 2872921
Verified drivers:
Name: ntoskrnl.exe, loads: 1, unloads: 0
CurrentPagedPoolAllocations: 83397
CurrentNonPagedPoolAllocations: 77485
PeakPagedPoolAllocations: 87305
PeakNonPagedPoolAllocations: 77674
PagedPoolUsageInBytes: 49624396
NonPagedPoolUsageInBytes: 11791484
PeakPagedPoolUsageInBytes: 49827760
PeakNonPagedPoolUsageInBytes: 12139000
Name: hal.dll, loads: 1, unloads: 0
CurrentPagedPoolAllocations: 0
CurrentNonPagedPoolAllocations: 4
PeakPagedPoolAllocations: 8
PeakNonPagedPoolAllocations: 6
PagedPoolUsageInBytes: 0
NonPagedPoolUsageInBytes: 992
PeakPagedPoolUsageInBytes: 768
PeakNonPagedPoolUsageInBytes: 32784
Name: fltmgr.sys, loads: 1, unloads: 0
CurrentPagedPoolAllocations: 2
CurrentNonPagedPoolAllocations: 7161
PeakPagedPoolAllocations: 16
PeakNonPagedPoolAllocations: 7173
PagedPoolUsageInBytes: 16
NonPagedPoolUsageInBytes: 1166244
PeakPagedPoolUsageInBytes: 3440
PeakNonPagedPoolUsageInBytes: 1169508
Name: ntfs.sys, loads: 1, unloads: 0
CurrentPagedPoolAllocations: 32443
CurrentNonPagedPoolAllocations: 28514
PeakPagedPoolAllocations: 33133
PeakNonPagedPoolAllocations: 29174
PagedPoolUsageInBytes: 9261776
NonPagedPoolUsageInBytes: 1880368
PeakPagedPoolUsageInBytes: 9472944
PeakNonPagedPoolUsageInBytes: 1965028
happening on my system. I've already had 4 crashes so far over the past
two weeks. So I've identified that NTOSKRNL.EXE is involved in all of
them so far. It always somewhere in the stack. So I enabled Driver
Verifier on NTOSKRNL, as well as HAL.DLL, NTFS.SYS, and FLTMGR.SYS which
were also identified on the stack during various of the events.
Okay so I had my latest crash yesterday, and it occurred on NTOSKRNL as
well. The Verifier was already enabled on the system prior to this
crash, and then when go to Windbg and execute the "!verifier" command,
it comes back with the message, "Unable to get verifier list". Why not,
it should be enabled?
When I check them on the command-prompt I get the following output back,
and they confirm that all of the files are being monitored. So can
somebody familiar with Driver Verifier and Windbg help me out here?
Yousuf Khan
***
verifier /query
10/01/2010, 3:30:34 PMLevel: 0000009B
RaiseIrqls: 314843045
AcquireSpinLocks: 1893615496
SynchronizeExecutions: 0
AllocationsAttempted: 90514901
AllocationsSucceeded: 90514901
AllocationsSucceededSpecialPool: 7614086
AllocationsWithNoTag: 0
AllocationsFailed: 0
AllocationsFailedDeliberately: 0
Trims: 2452146
UnTrackedPool: 2872921
Verified drivers:
Name: ntoskrnl.exe, loads: 1, unloads: 0
CurrentPagedPoolAllocations: 83397
CurrentNonPagedPoolAllocations: 77485
PeakPagedPoolAllocations: 87305
PeakNonPagedPoolAllocations: 77674
PagedPoolUsageInBytes: 49624396
NonPagedPoolUsageInBytes: 11791484
PeakPagedPoolUsageInBytes: 49827760
PeakNonPagedPoolUsageInBytes: 12139000
Name: hal.dll, loads: 1, unloads: 0
CurrentPagedPoolAllocations: 0
CurrentNonPagedPoolAllocations: 4
PeakPagedPoolAllocations: 8
PeakNonPagedPoolAllocations: 6
PagedPoolUsageInBytes: 0
NonPagedPoolUsageInBytes: 992
PeakPagedPoolUsageInBytes: 768
PeakNonPagedPoolUsageInBytes: 32784
Name: fltmgr.sys, loads: 1, unloads: 0
CurrentPagedPoolAllocations: 2
CurrentNonPagedPoolAllocations: 7161
PeakPagedPoolAllocations: 16
PeakNonPagedPoolAllocations: 7173
PagedPoolUsageInBytes: 16
NonPagedPoolUsageInBytes: 1166244
PeakPagedPoolUsageInBytes: 3440
PeakNonPagedPoolUsageInBytes: 1169508
Name: ntfs.sys, loads: 1, unloads: 0
CurrentPagedPoolAllocations: 32443
CurrentNonPagedPoolAllocations: 28514
PeakPagedPoolAllocations: 33133
PeakNonPagedPoolAllocations: 29174
PagedPoolUsageInBytes: 9261776
NonPagedPoolUsageInBytes: 1880368
PeakPagedPoolUsageInBytes: 9472944
PeakNonPagedPoolUsageInBytes: 1965028