search

desowin / usbpcap

USB packet capture for Windows
http://desowin.org/usbpcap
896 stars 170 forks source link

EXRESOURCE_TIMEOUT_LIVEDUMP #131

Open kouzhudong opened 1 year ago

kouzhudong commented 1 year ago 
0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

EXRESOURCE_TIMEOUT_LIVEDUMP (1cc)
A kernel ERESOURCE has timed out. This can indicate a deadlock condition or
heavy contention which can cause performance issues.
Arguments:
Arg1: fffff80146e44ba0, The ERESOURCE that has timed out
Arg2: ffffc4079d763040, The thread that detected the timeout
Arg3: 00000000000001f3, The ERESOURCE contention count
Arg4: 0000000000000096, The configured timeout in seconds

Debugging Details:
------------------

Unable to load image \SystemRoot\system32\DRIVERS\USBPcap.sys, Win32 error 0n2
Unable to load image \SystemRoot\System32\drivers\vmusb.sys, Win32 error 0n2

KEY_VALUES_STRING: 1

    Key  : Analysis.CPU.mSec
    Value: 3953

    Key  : Analysis.DebugAnalysisManager
    Value: Create

    Key  : Analysis.Elapsed.mSec
    Value: 24182

    Key  : Analysis.Init.CPU.mSec
    Value: 562

    Key  : Analysis.Init.Elapsed.mSec
    Value: 10630

    Key  : Analysis.Memory.CommitPeak.Mb
    Value: 89

    Key  : WER.OS.Branch
    Value: vb_release

    Key  : WER.OS.Timestamp
    Value: 2019-12-06T14:06:00Z

    Key  : WER.OS.Version
    Value: 10.0.19041.1

FILE_IN_CAB:  ResourceTimeout-20230602-2138.dmp

DUMP_FILE_ATTRIBUTES: 0x10
  Live Generated Dump

BUGCHECK_CODE:  1cc

BUGCHECK_P1: fffff80146e44ba0

BUGCHECK_P2: ffffc4079d763040

BUGCHECK_P3: 1f3

BUGCHECK_P4: 96

FAULTING_THREAD:  ffffc40794dd3040

PROCESS_NAME:  System

LOCK_ADDRESS:  fffff80146e44ba0 -- (!locks fffff80146e44ba0)

Resource @ nt!PiEngineLock (0xfffff80146e44ba0)    Exclusively owned
    Contention Count = 499
    NumberOfExclusiveWaiters = 2
     Threads: ffffc40794dd3040-01<*> 

     Threads Waiting On Exclusive Access:
              ffffc407961c7080       ffffc4079d763040       
1 total locks

PNP_TRIAGE_DATA: 
    Lock address  : 0xfffff80146e44ba0
    Thread Count  : 1
    Thread address: 0xffffc40794dd3040
    Thread wait   : 0x21e637

STACK_TEXT:  
fffff501`94e14b20 fffff801`4641c9c0     : ffff8c80`af200180 ffffc407`94dd3040 00000000`00000000 ffffc407`988c6158 : nt!KiSwapContext+0x76
fffff501`94e14c60 fffff801`4641beef     : ffffc407`94dd3040 00000000`00000000 fffff501`94e14e20 fffff801`4bb0f000 : nt!KiSwapThread+0x500
fffff501`94e14d10 fffff801`4641b793     : fffff801`00000000 00000000`00000000 00000000`00000000 ffffc407`94dd3180 : nt!KiCommitThreadWait+0x14f
fffff501`94e14db0 fffff801`6b692c53     : fffff501`94e14ed0 00000000`00000000 00000000`00000000 11d1c85d`9d7deb00 : nt!KeWaitForSingleObject+0x233
fffff501`94e14ea0 fffff801`6b6932c0     : 00000000`00000000 ffffc407`9a348ec0 ffffc407`9a348ea0 00000000`00000000 : USBPcap+0x2c53
fffff501`94e14f00 fffff801`6b693115     : ffffc407`a0b1ea60 fffff501`94e15150 00000000`00000000 ffffc407`9a348ea0 : USBPcap+0x32c0
fffff501`94e14f50 fffff801`46411385     : ffffc407`a0296ca0 fffff501`94e15150 00000000`00000000 ffffc407`00000000 : USBPcap+0x3115
fffff501`94e14f90 fffff801`926d58fd     : ffffc407`a0296ca0 fffff501`94e15150 ffffc407`9a348d50 ffffc407`a0b1ea60 : nt!IofCallDriver+0x55
fffff501`94e14fd0 fffff801`46411385     : ffffc407`a0b1ea60 ffffc407`a0296b50 ffffc407`a0987d40 00000000`00000300 : vmusb+0x58fd
fffff501`94e15030 fffff801`46965b4e     : ffffc407`a0987d40 ffffc407`a167dee0 00000000`00000000 00000000`00000000 : nt!IofCallDriver+0x55
fffff501`94e15070 fffff801`464045ee     : ffffc407`a0987d40 00000000`00000000 ffffc407`a167dee0 fffff801`4656dd1c : nt!PnpAsynchronousCall+0xea
fffff501`94e150b0 fffff801`4656dba0     : 00000000`00000000 ffffc407`a0987d40 fffff801`4656d250 fffff801`4656d250 : nt!PnpSendIrp+0x9e
fffff501`94e15120 fffff801`4693b094     : ffffc407`9d841560 00000000`00000000 ffffc407`a167dee0 00000000`00000300 : nt!PnpStartDevice+0x88
fffff501`94e151b0 fffff801`4693b3fb     : ffffc407`9d841560 00000000`00000000 00000000`00000001 fffff801`4656d6f2 : nt!PnpStartDeviceNode+0xec
fffff501`94e15240 fffff801`46935d69     : ffffc407`9d841560 fffff501`94e15311 00000000`00000000 00000000`00000001 : nt!PipProcessStartPhase1+0x73
fffff501`94e15290 fffff801`4693f484     : ffffc407`95ce0700 fffff801`46420b01 fffff501`94e153b0 fffff801`00000002 : nt!PipProcessDevNodeTree+0x319
fffff501`94e15360 fffff801`4656ed56     : 00000001`00000003 ffffc407`8e59ec50 ffffc407`95ce0700 ffffc407`95ce0700 : nt!PiProcessReenumeration+0x88
fffff501`94e153b0 fffff801`4648e5c5     : ffffc407`94dd3040 ffffc407`86093a20 fffff801`46e433c0 00000000`00000000 : nt!PnpDeviceActionWorker+0x206
fffff501`94e15470 fffff801`465265f5     : ffffc407`94dd3040 00000000`00000080 ffffc407`860c8080 ce08013c`97000000 : nt!ExpWorkerThread+0x105
fffff501`94e15510 fffff801`466048d8     : ffff8c80`af200180 ffffc407`94dd3040 fffff801`465265a0 bf040000`00ae6703 : nt!PspSystemThreadStartup+0x55
fffff501`94e15560 00000000`00000000     : fffff501`94e16000 fffff501`94e0f000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x28

SYMBOL_NAME:  USBPcap+2c53

MODULE_NAME: USBPcap

IMAGE_NAME:  USBPcap.sys

STACK_COMMAND:  .process /r /p 0xffffc407860c8080; .thread 0xffffc40794dd3040 ; kb

BUCKET_ID_FUNC_OFFSET:  2c53

FAILURE_BUCKET_ID:  LKD_0x1cc_EXRESOURCE_TIMEOUT_OWNERTHREAD_USBPcap!unknown_function

OS_VERSION:  10.0.19041.1

BUILDLAB_STR:  vb_release

OSPLATFORM_TYPE:  x64

OSNAME:  Windows 10

FAILURE_ID_HASH:  {466c4475-69e5-177b-f102-9a1a893ac0a0}

Followup:     MachineOwner
---------

0: kd> lmvm USBPcap
Browse full module list
start             end                 module name
fffff801`6b690000 fffff801`6b69e000   USBPcap    (no symbols)           
    Loaded symbol image file: USBPcap.sys
    Image path: \SystemRoot\system32\DRIVERS\USBPcap.sys
    Image name: USBPcap.sys
    Browse all global symbols  functions  data
    Timestamp:        Fri May 22 17:02:16 2020 (5EC79518)
    CheckSum:         00017933
    ImageSize:        0000E000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4
    Information from resource tables:
0: kd> .process /r /p 0xffffc407860c8080; .thread 0xffffc40794dd3040 ; kb
Implicit process is now ffffc407`860c8080
Loading User Symbols

************* Symbol Loading Error Summary **************
Module name            Error
USBPcap                The system cannot find the file specified
vmusb                  The system cannot find the file specified

You can troubleshoot most symbol related issues by turning on symbol loading diagnostics (!sym noisy) and repeating the command that caused symbols to be loaded.
You should also verify that your symbol search path (.sympath) is correct.
Implicit thread is now ffffc407`94dd3040
  *** Stack trace for last set context - .thread/.cxr resets it
 # RetAddr               : Args to Child                                                           : Call Site
00 fffff801`4641c9c0     : ffff8c80`af200180 ffffc407`94dd3040 00000000`00000000 ffffc407`988c6158 : nt!KiSwapContext+0x76
01 fffff801`4641beef     : ffffc407`94dd3040 00000000`00000000 fffff501`94e14e20 fffff801`4bb0f000 : nt!KiSwapThread+0x500
02 fffff801`4641b793     : fffff801`00000000 00000000`00000000 00000000`00000000 ffffc407`94dd3180 : nt!KiCommitThreadWait+0x14f
03 fffff801`6b692c53     : fffff501`94e14ed0 00000000`00000000 00000000`00000000 11d1c85d`9d7deb00 : nt!KeWaitForSingleObject+0x233
04 fffff801`6b6932c0     : 00000000`00000000 ffffc407`9a348ec0 ffffc407`9a348ea0 00000000`00000000 : USBPcap+0x2c53
05 fffff801`6b693115     : ffffc407`a0b1ea60 fffff501`94e15150 00000000`00000000 ffffc407`9a348ea0 : USBPcap+0x32c0
06 fffff801`46411385     : ffffc407`a0296ca0 fffff501`94e15150 00000000`00000000 ffffc407`00000000 : USBPcap+0x3115
07 fffff801`926d58fd     : ffffc407`a0296ca0 fffff501`94e15150 ffffc407`9a348d50 ffffc407`a0b1ea60 : nt!IofCallDriver+0x55
08 fffff801`46411385     : ffffc407`a0b1ea60 ffffc407`a0296b50 ffffc407`a0987d40 00000000`00000300 : vmusb+0x58fd
09 fffff801`46965b4e     : ffffc407`a0987d40 ffffc407`a167dee0 00000000`00000000 00000000`00000000 : nt!IofCallDriver+0x55
0a fffff801`464045ee     : ffffc407`a0987d40 00000000`00000000 ffffc407`a167dee0 fffff801`4656dd1c : nt!PnpAsynchronousCall+0xea
0b fffff801`4656dba0     : 00000000`00000000 ffffc407`a0987d40 fffff801`4656d250 fffff801`4656d250 : nt!PnpSendIrp+0x9e
0c fffff801`4693b094     : ffffc407`9d841560 00000000`00000000 ffffc407`a167dee0 00000000`00000300 : nt!PnpStartDevice+0x88
0d fffff801`4693b3fb     : ffffc407`9d841560 00000000`00000000 00000000`00000001 fffff801`4656d6f2 : nt!PnpStartDeviceNode+0xec
0e fffff801`46935d69     : ffffc407`9d841560 fffff501`94e15311 00000000`00000000 00000000`00000001 : nt!PipProcessStartPhase1+0x73
0f fffff801`4693f484     : ffffc407`95ce0700 fffff801`46420b01 fffff501`94e153b0 fffff801`00000002 : nt!PipProcessDevNodeTree+0x319
10 fffff801`4656ed56     : 00000001`00000003 ffffc407`8e59ec50 ffffc407`95ce0700 ffffc407`95ce0700 : nt!PiProcessReenumeration+0x88
11 fffff801`4648e5c5     : ffffc407`94dd3040 ffffc407`86093a20 fffff801`46e433c0 00000000`00000000 : nt!PnpDeviceActionWorker+0x206
12 fffff801`465265f5     : ffffc407`94dd3040 00000000`00000080 ffffc407`860c8080 ce08013c`97000000 : nt!ExpWorkerThread+0x105
13 fffff801`466048d8     : ffff8c80`af200180 ffffc407`94dd3040 fffff801`465265a0 bf040000`00ae6703 : nt!PspSystemThreadStartup+0x55
14 00000000`00000000     : fffff501`94e16000 fffff501`94e0f000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x28
0: kd> .process /r /p 0xffffc407860c8080; .thread 0xffffc40794dd3040 ; kb
Implicit process is now ffffc407`860c8080
Loading User Symbols

************* Symbol Loading Error Summary **************
Module name            Error
USBPcap                The system cannot find the file specified
vmusb                  The system cannot find the file specified

You can troubleshoot most symbol related issues by turning on symbol loading diagnostics (!sym noisy) and repeating the command that caused symbols to be loaded.
You should also verify that your symbol search path (.sympath) is correct.
Implicit thread is now ffffc407`94dd3040
  *** Stack trace for last set context - .thread/.cxr resets it
 # RetAddr               : Args to Child                                                           : Call Site
00 fffff801`4641c9c0     : ffff8c80`af200180 ffffc407`94dd3040 00000000`00000000 ffffc407`988c6158 : nt!KiSwapContext+0x76
01 fffff801`4641beef     : ffffc407`94dd3040 00000000`00000000 fffff501`94e14e20 fffff801`4bb0f000 : nt!KiSwapThread+0x500
02 fffff801`4641b793     : fffff801`00000000 00000000`00000000 00000000`00000000 ffffc407`94dd3180 : nt!KiCommitThreadWait+0x14f
03 fffff801`6b692c53     : fffff501`94e14ed0 00000000`00000000 00000000`00000000 11d1c85d`9d7deb00 : nt!KeWaitForSingleObject+0x233
04 fffff801`6b6932c0     : 00000000`00000000 ffffc407`9a348ec0 ffffc407`9a348ea0 00000000`00000000 : USBPcap+0x2c53
05 fffff801`6b693115     : ffffc407`a0b1ea60 fffff501`94e15150 00000000`00000000 ffffc407`9a348ea0 : USBPcap+0x32c0
06 fffff801`46411385     : ffffc407`a0296ca0 fffff501`94e15150 00000000`00000000 ffffc407`00000000 : USBPcap+0x3115
07 fffff801`926d58fd     : ffffc407`a0296ca0 fffff501`94e15150 ffffc407`9a348d50 ffffc407`a0b1ea60 : nt!IofCallDriver+0x55
08 fffff801`46411385     : ffffc407`a0b1ea60 ffffc407`a0296b50 ffffc407`a0987d40 00000000`00000300 : vmusb+0x58fd
09 fffff801`46965b4e     : ffffc407`a0987d40 ffffc407`a167dee0 00000000`00000000 00000000`00000000 : nt!IofCallDriver+0x55
0a fffff801`464045ee     : ffffc407`a0987d40 00000000`00000000 ffffc407`a167dee0 fffff801`4656dd1c : nt!PnpAsynchronousCall+0xea
0b fffff801`4656dba0     : 00000000`00000000 ffffc407`a0987d40 fffff801`4656d250 fffff801`4656d250 : nt!PnpSendIrp+0x9e
0c fffff801`4693b094     : ffffc407`9d841560 00000000`00000000 ffffc407`a167dee0 00000000`00000300 : nt!PnpStartDevice+0x88
0d fffff801`4693b3fb     : ffffc407`9d841560 00000000`00000000 00000000`00000001 fffff801`4656d6f2 : nt!PnpStartDeviceNode+0xec
0e fffff801`46935d69     : ffffc407`9d841560 fffff501`94e15311 00000000`00000000 00000000`00000001 : nt!PipProcessStartPhase1+0x73
0f fffff801`4693f484     : ffffc407`95ce0700 fffff801`46420b01 fffff501`94e153b0 fffff801`00000002 : nt!PipProcessDevNodeTree+0x319
10 fffff801`4656ed56     : 00000001`00000003 ffffc407`8e59ec50 ffffc407`95ce0700 ffffc407`95ce0700 : nt!PiProcessReenumeration+0x88
11 fffff801`4648e5c5     : ffffc407`94dd3040 ffffc407`86093a20 fffff801`46e433c0 00000000`00000000 : nt!PnpDeviceActionWorker+0x206
12 fffff801`465265f5     : ffffc407`94dd3040 00000000`00000080 ffffc407`860c8080 ce08013c`97000000 : nt!ExpWorkerThread+0x105
13 fffff801`466048d8     : ffff8c80`af200180 ffffc407`94dd3040 fffff801`465265a0 bf040000`00ae6703 : nt!PspSystemThreadStartup+0x55
14 00000000`00000000     : fffff501`94e16000 fffff501`94e0f000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x28
0: kd> .process /r /p 0xffffc407860c8080; .thread 0xffffc40794dd3040 ; kb
Implicit process is now ffffc407`860c8080
Loading User Symbols

************* Symbol Loading Error Summary **************
Module name            Error
USBPcap                The system cannot find the file specified
vmusb                  The system cannot find the file specified

You can troubleshoot most symbol related issues by turning on symbol loading diagnostics (!sym noisy) and repeating the command that caused symbols to be loaded.
You should also verify that your symbol search path (.sympath) is correct.
Implicit thread is now ffffc407`94dd3040
  *** Stack trace for last set context - .thread/.cxr resets it
 # RetAddr               : Args to Child                                                           : Call Site
00 fffff801`4641c9c0     : ffff8c80`af200180 ffffc407`94dd3040 00000000`00000000 ffffc407`988c6158 : nt!KiSwapContext+0x76
01 fffff801`4641beef     : ffffc407`94dd3040 00000000`00000000 fffff501`94e14e20 fffff801`4bb0f000 : nt!KiSwapThread+0x500
02 fffff801`4641b793     : fffff801`00000000 00000000`00000000 00000000`00000000 ffffc407`94dd3180 : nt!KiCommitThreadWait+0x14f
03 fffff801`6b692c53     : fffff501`94e14ed0 00000000`00000000 00000000`00000000 11d1c85d`9d7deb00 : nt!KeWaitForSingleObject+0x233
04 fffff801`6b6932c0     : 00000000`00000000 ffffc407`9a348ec0 ffffc407`9a348ea0 00000000`00000000 : USBPcap+0x2c53
05 fffff801`6b693115     : ffffc407`a0b1ea60 fffff501`94e15150 00000000`00000000 ffffc407`9a348ea0 : USBPcap+0x32c0
06 fffff801`46411385     : ffffc407`a0296ca0 fffff501`94e15150 00000000`00000000 ffffc407`00000000 : USBPcap+0x3115
07 fffff801`926d58fd     : ffffc407`a0296ca0 fffff501`94e15150 ffffc407`9a348d50 ffffc407`a0b1ea60 : nt!IofCallDriver+0x55
08 fffff801`46411385     : ffffc407`a0b1ea60 ffffc407`a0296b50 ffffc407`a0987d40 00000000`00000300 : vmusb+0x58fd
09 fffff801`46965b4e     : ffffc407`a0987d40 ffffc407`a167dee0 00000000`00000000 00000000`00000000 : nt!IofCallDriver+0x55
0a fffff801`464045ee     : ffffc407`a0987d40 00000000`00000000 ffffc407`a167dee0 fffff801`4656dd1c : nt!PnpAsynchronousCall+0xea
0b fffff801`4656dba0     : 00000000`00000000 ffffc407`a0987d40 fffff801`4656d250 fffff801`4656d250 : nt!PnpSendIrp+0x9e
0c fffff801`4693b094     : ffffc407`9d841560 00000000`00000000 ffffc407`a167dee0 00000000`00000300 : nt!PnpStartDevice+0x88
0d fffff801`4693b3fb     : ffffc407`9d841560 00000000`00000000 00000000`00000001 fffff801`4656d6f2 : nt!PnpStartDeviceNode+0xec
0e fffff801`46935d69     : ffffc407`9d841560 fffff501`94e15311 00000000`00000000 00000000`00000001 : nt!PipProcessStartPhase1+0x73
0f fffff801`4693f484     : ffffc407`95ce0700 fffff801`46420b01 fffff501`94e153b0 fffff801`00000002 : nt!PipProcessDevNodeTree+0x319
10 fffff801`4656ed56     : 00000001`00000003 ffffc407`8e59ec50 ffffc407`95ce0700 ffffc407`95ce0700 : nt!PiProcessReenumeration+0x88
11 fffff801`4648e5c5     : ffffc407`94dd3040 ffffc407`86093a20 fffff801`46e433c0 00000000`00000000 : nt!PnpDeviceActionWorker+0x206
12 fffff801`465265f5     : ffffc407`94dd3040 00000000`00000080 ffffc407`860c8080 ce08013c`97000000 : nt!ExpWorkerThread+0x105
13 fffff801`466048d8     : ffff8c80`af200180 ffffc407`94dd3040 fffff801`465265a0 bf040000`00ae6703 : nt!PspSystemThreadStartup+0x55
14 00000000`00000000     : fffff501`94e16000 fffff501`94e0f000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x28
0: kd> .process /r /p 0xffffc407860c8080; .thread 0xffffc40794dd3040 ; kb
Implicit process is now ffffc407`860c8080
Loading User Symbols

************* Symbol Loading Error Summary **************
Module name            Error
USBPcap                The system cannot find the file specified
vmusb                  The system cannot find the file specified

You can troubleshoot most symbol related issues by turning on symbol loading diagnostics (!sym noisy) and repeating the command that caused symbols to be loaded.
You should also verify that your symbol search path (.sympath) is correct.
Implicit thread is now ffffc407`94dd3040
  *** Stack trace for last set context - .thread/.cxr resets it
 # RetAddr               : Args to Child                                                           : Call Site
00 fffff801`4641c9c0     : ffff8c80`af200180 ffffc407`94dd3040 00000000`00000000 ffffc407`988c6158 : nt!KiSwapContext+0x76
01 fffff801`4641beef     : ffffc407`94dd3040 00000000`00000000 fffff501`94e14e20 fffff801`4bb0f000 : nt!KiSwapThread+0x500
02 fffff801`4641b793     : fffff801`00000000 00000000`00000000 00000000`00000000 ffffc407`94dd3180 : nt!KiCommitThreadWait+0x14f
03 fffff801`6b692c53     : fffff501`94e14ed0 00000000`00000000 00000000`00000000 11d1c85d`9d7deb00 : nt!KeWaitForSingleObject+0x233
04 fffff801`6b6932c0     : 00000000`00000000 ffffc407`9a348ec0 ffffc407`9a348ea0 00000000`00000000 : USBPcap+0x2c53
05 fffff801`6b693115     : ffffc407`a0b1ea60 fffff501`94e15150 00000000`00000000 ffffc407`9a348ea0 : USBPcap+0x32c0
06 fffff801`46411385     : ffffc407`a0296ca0 fffff501`94e15150 00000000`00000000 ffffc407`00000000 : USBPcap+0x3115
07 fffff801`926d58fd     : ffffc407`a0296ca0 fffff501`94e15150 ffffc407`9a348d50 ffffc407`a0b1ea60 : nt!IofCallDriver+0x55
08 fffff801`46411385     : ffffc407`a0b1ea60 ffffc407`a0296b50 ffffc407`a0987d40 00000000`00000300 : vmusb+0x58fd
09 fffff801`46965b4e     : ffffc407`a0987d40 ffffc407`a167dee0 00000000`00000000 00000000`00000000 : nt!IofCallDriver+0x55
0a fffff801`464045ee     : ffffc407`a0987d40 00000000`00000000 ffffc407`a167dee0 fffff801`4656dd1c : nt!PnpAsynchronousCall+0xea
0b fffff801`4656dba0     : 00000000`00000000 ffffc407`a0987d40 fffff801`4656d250 fffff801`4656d250 : nt!PnpSendIrp+0x9e
0c fffff801`4693b094     : ffffc407`9d841560 00000000`00000000 ffffc407`a167dee0 00000000`00000300 : nt!PnpStartDevice+0x88
0d fffff801`4693b3fb     : ffffc407`9d841560 00000000`00000000 00000000`00000001 fffff801`4656d6f2 : nt!PnpStartDeviceNode+0xec
0e fffff801`46935d69     : ffffc407`9d841560 fffff501`94e15311 00000000`00000000 00000000`00000001 : nt!PipProcessStartPhase1+0x73
0f fffff801`4693f484     : ffffc407`95ce0700 fffff801`46420b01 fffff501`94e153b0 fffff801`00000002 : nt!PipProcessDevNodeTree+0x319
10 fffff801`4656ed56     : 00000001`00000003 ffffc407`8e59ec50 ffffc407`95ce0700 ffffc407`95ce0700 : nt!PiProcessReenumeration+0x88
11 fffff801`4648e5c5     : ffffc407`94dd3040 ffffc407`86093a20 fffff801`46e433c0 00000000`00000000 : nt!PnpDeviceActionWorker+0x206
12 fffff801`465265f5     : ffffc407`94dd3040 00000000`00000080 ffffc407`860c8080 ce08013c`97000000 : nt!ExpWorkerThread+0x105
13 fffff801`466048d8     : ffff8c80`af200180 ffffc407`94dd3040 fffff801`465265a0 bf040000`00ae6703 : nt!PspSystemThreadStartup+0x55
14 00000000`00000000     : fffff501`94e16000 fffff501`94e0f000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x28
kouzhudong commented 1 year ago

关机卡死的罪魁祸首，发现在这里：C:\Windows\LiveKernelReports，这里有五六个DUMP文件。

C:\Windows\LiveKernelReports>tree /F 卷 Windows 的文件夹 PATH 列表 卷序列号为 86B6-CF2D C:. │ ResourceTimeout-20230602-2138.dmp │ ├─ResourceTimeout │ ResourceTimeout-20230602-2138.dmp │ ├─USBHUB3 │ USBHUB3-20230601-0900.dmp │ USBHUB3-20230602-2128.dmp │ USBHUB3-20230605-1017.dmp │ └─WATCHDOG

C:\Windows\LiveKernelReports>

kouzhudong commented 1 year ago

而且还经常出现USB鼠标无法使用的情况。

desowin commented 1 year ago

Please download https://github.com/desowin/usbpcap/releases/download/1.5.4.0/usbpcap-src-incl-pdb-1.5.4.0.7z and load the USBPcap.pdb file for analysis. After loading pdb, repeat the commands so the offsets turn into actual functions.

kouzhudong commented 1 year ago

the dump file i was deleted. in usbpcap\Release\Windows10\x64 no found pdb file.

kouzhudong commented 1 year ago

USBPcap+0x2c53 is in DkForwardAndWait.

desowin commented 1 year ago

the dump file i was deleted. in usbpcap\Release\Windows10\x64 no found pdb file.

Use the file from Windows8. The difference between the two is the Microsoft signature.