Windbg OS crash

[Alec]

Hi all:

We have several NTE boxes that experience sudden OS crash. Each system
utilizes proprietary hardware (built by Intel) and runs special
devices not found on a regular PC.

After the crash I was able to connect using WinDbg. Unfortunately I
was not able to get any valuable information that can shed some light
on the case. It is clearly not a bugchek/ BSOD since in that case I am
getting memory.dump, etc.Below is the log from my WinDbg session.
Interesting that "Debug session time" points to the moment when the
crash occurred.

I am wondering whether someone can help to identify in what state NTE
is in. Also what else I can do using Windbg that will help to identify
the problem?

Thank you

[Alec]

Hi all:

Microsoft (R) Windows Debugger Version 6.1.0017.2
Copyright (c) Microsoft Corporation. All rights reserved.

Opened \\.\com1
Waiting to reconnect...
Connected to Windows NT 4 1381 x86 compatible target, ptr64 FALSE
Kernel Debugger connection established.
Symbol search path is: *** Invalid *** : Verify _NT_SYMBOL_PATH
setting
Executable search path is:
ERROR: Unable to find system thread 41
ERROR: The thread being debugged has either exited or cannot be
accessed
ERROR: Many commands will not work properly
Windows NT 4 Kernel Version 1381 UP Free x86 compatible
Kernel base = 0x80100000 PsLoadedModuleList = 0x80150560
Debug session time: Mon Mar 10 01:07:12 2003
System Uptime: 2 days 12:19:32.278
ERROR: Exception 80000003 occurred on unknown thread 41
Break instruction exception - code 80000003 (first chance)
c0000005 Exception in ext.DebugExtensionNotify debugger extension.
PC: 02051da7 VA: 00000008 R/W: 0 Parameter: 0001001f
?: kd> !process
WARNING: The debugger does not have a current process or thread
WARNING: Many commands will not work
Extension called without current PC
Unable to read PCR for Processor 65535
Unable to get current process pointer.
?: kd> !irpfind
WARNING: The debugger does not have a current process or thread
WARNING: Many commands will not work
Extension called without current PC
unable to get nt!MmNonPagedPoolStart
unable to get nt!MmMaximumNonPagedPoolInBytes

Searching NonPaged pool (0 : 0) for Tag: Irp

unable to get PoolTrackTable
0 active irps
?: kd> kb
WARNING: The debugger does not have a current process or thread
WARNING: Many commands will not work
^ Illegal thread error in 'kb'
?: kd> !arbiter 4
WARNING: The debugger does not have a current process or thread
WARNING: Many commands will not work
No export arbiter found
?: kd> !pci 0
WARNING: The debugger does not have a current process or thread
WARNING: Many commands will not work
Extension called without current PC
PCI Bus 0
00:0 8086:7192.03 Cmd[0006:.mb...] Sts[2200:.....] Intel Host
Bridge
07:0 8086:7110.02 Cmd[000f:imb...] Sts[0280:.....] Intel ISA
Bridge
07:1 8086:7111.01 Cmd[0005:i.b...] Sts[0280:.....] Intel IDE
Controller
07:2 8086:7112.01 Cmd[0005:i.b...] Sts[0280:.....] Intel USB
Controller
07:3 8086:7113.02 Cmd[0003:im....] Sts[0280:.....] Intel Other
Bridge
0e:0 12c7:0708.00 Cmd[0003:im....] Sts[0280:.....] Dialogic
Class:ff:ff:1 SubID:12c7:0708
0f:0 12c7:0708.00 Cmd[0003:im....] Sts[0280:.....] Dialogic
Class:ff:ff:1 SubID:12c7:0708
10:0 8086:1209.09 Cmd[0007:imb...] Sts[0290:c....] Intel Ethernet
Controller
?: kd> k
WARNING: The debugger does not have a current process or thread
WARNING: Many commands will not work
^ Illegal thread error in 'k'
?: kd> !THREAD
WARNING: The debugger does not have a current process or thread
WARNING: Many commands will not work
Extension called without current PC
Unable to read PCR for Processor 65535
ReadMemoryError 8000ffff at 00000000
00000000: Unable to get thread contents
?: kd> !bugdump
WARNING: The debugger does not have a current process or thread
WARNING: Many commands will not work
Extension called without current PC
**** Dump of Bug Check Data ****
00000004: No bug check callback data available
?: kd> r
WARNING: The debugger does not have a current process or thread
WARNING: Many commands will not work
^ Illegal thread error in 'r'
?: kd> kb
WARNING: The debugger does not have a current process or thread
WARNING: Many commands will not work
^ Illegal thread error in 'kb'
?: kd> !process 0 7
WARNING: The debugger does not have a current process or thread
WARNING: Many commands will not work
Extension called without current PC
**** NT ACTIVE PROCESS DUMP ****
Unable to get value of PsActiveProcessHead
?: kd> !module
WARNING: The debugger does not have a current process or thread
WARNING: Many commands will not work
No export module found
?: kd> !vm
WARNING: The debugger does not have a current process or thread
WARNING: Many commands will not work
Extension called without current PC

*** Virtual Memory Usage ***
unable to get MmNumberOfPhysicalPages
Physical Memory: 0 ( 0 Kb)
unable to get MmNumberOfPagingFiles

************ NO PAGING FILE *********************

unable to get MmTotalCommitLimit
unable to get MmTotalCommittedPages
unable to get MmSharedCommit
unable to get MmDriverCommit
unable to get MmProcessCommit
unable to get MmPagedPoolCommit
unable to get MmZeroedPageListHead
unable to get MmFreePageListHead
unable to get MmStandbyPageListHead
unable to get MmModifiedPageListHead
unable to get MmModifiedNoWritePageListHead
unable to get MmAvailablePages
unable to get MmResidentAvailablePages
unable to get MmExtendedCommit
Available Pages: 0 ( 0 Kb)
Modified Pages: 0 ( 0 Kb)

Running out of physical memory
00000000: Unable to get pool descriptor
?: kd> !ready
WARNING: The debugger does not have a current process or thread
WARNING: Many commands will not work
Extension called without current PC
Could not determine address of KiDispatcherReadyListHead

Thank you

[David Holcomb [MS]]

In this case can you do two things.

1) Repro the problem but do Ctrl+D as soon as you launch kd. This way we
can trace the debugger protocol up to the time of the crash. I assume after
the extension crashes the debugger is 100% completely unresponsive to any
commands?
2) Run kd under the debugger and when the 1st chance AV occurs in the
extension, issue .dump /ma c:\ext_av.dmp and ZIP or CAB up the dump. Then
we'll have to arrange how you can get the dump and the log to me.

--
--
This posting is provided "AS IS" with no warranties, and confers no rights.

"Alec" <ale...@cox.net> wrote in message
news:8ddde514.03031...@posting.google.com...