Windows XP bazen sistemde bir hata oluştuğunda mavi ekran çıkartır.Bir takım bilgilerden sonra memory dump yaptığını belirtip uzun süre %SystemRoot% içine MEMORY.DMP dosyasını save edip sonra restart yapar.Bu olay nedir niye olur.Bunlara cevap vereceğiz.Aşağıdaki bilgiler the Microsoft Knowledge Base'den tercüme edilmiştir.
Bazen sistem çöker mavi ekran çıkar. uzun bilgilerden sonra en altta şöyle bir satır görebiliriz.
Windows includes a feature that you can use to cause the system to stop responding and to generate a Memory.dmp file (if configured to do so). The "Stop" screen that is generated contains the following parameters:
*** STOP: 0x000000E2 (0x00000000,0x00000000,0x00000000,0x00000000)
Rakamlar değişebilir .Her hatanın kendine ait değerleri vardır. Sistem resart yapmadan önce recovery için bir log file oluşturup. C:WINNTMEMORY.DMP olarak save eder.Memory.dmp dosyasını 3 farklı şekilde düzenleyebiliriz;Complete memory dump , Kernel memory dump , Small memory dump .Bunun için
1. Click Start,Control Panel, Performance and Maintenance,
2. Click System.
3. Advanced tab, click Startup and Recovery.
4. Click Setting
5. write debugging information
6. Seçimini yap
7. system failure'da automatically restart'ı şeçersen restart eder.Resimler Sadece üyeler içindir!
ulas>ulas>form
Complete Memory Dump
Sistem istenilmeyen bir zamanda bir sistem hatasından dolayı durur ise " complete memory dump" sistem memory'sini tamamı ile %SystemRoot%Memory.dmp dosyasına kaydeder .Sistemde defaultur. En fazla yer tutan seçenektir.yaklaşık olarak fiziksel memory + 1 GB yer tutabilir.Toplam 2 GB ile limitlenmiştir.
Kernel Memory Dump
Kernel memory dump sadece kernel memory'yi save eder. Daha hızlıdır. RAM miktarına bağlı olarak 50Mb ile 800 MB arasında değişir.
Bu dosya Windows 2000 kernel ve hardware abstraction level (HAL), r Kernel-mode programları ihtiva eder. the complete memory dump'tan küçüktür.
Small Memory Dump
Sistemin durmasına neden olan bilgileri kaydeder. 2 MB civarında yer tutar.
Aşağıdaki bilgileri ihtiva eder.:
· The stop message and parameters
· drivers listesi
· Sistemi durduran process için The processor context (PRCB)
· Sistemi durduran process için The process information and kernel context (EPROCESS)
· The process information and kernel context (ETHREAD) for the thread that stopped
· The Kernel-mode call stack for the thread that stopped
Dumpchk.exe dosyasını command prompt'ta çalıştırırsak aşağıdaki örneğe benzer olan dokumanı görürüz.
dumpchk.exe Memory.dmp
MachineImageType i386
NumberProcessors 1
BugCheckCode 0xc000021a
BugCheckParameter1 0xe1270188
BugCheckParameter2 0x00000001
BugCheckParameter3 0x00000000
BugCheckParameter4 0x00000000
ExceptionCode 0x80000003
ExceptionFlags 0x00000001
ExceptionAddress 0x8014fb84
Bu bilgiler durma nedeni hakkında bilgiler ( stop code) verir.. stop code (0xc000021a) and the parameters (0xe1270188, 0x00000001, 0x00000000, 0x00000000), exception (0x8014fb84) addressinin driverları . Bu adresler driver tesbitinde kullanılır.Bunun için Resource Kit. içinde bulunan Pstat.exe dosyası kullanılır.
Pstat.exe dosyası Resource Kit utility dosyasıdır ve Halen çalışmakta olan processes ve drivers hakkında bilgi verir.Aşağıda bir örnek vardır:
pstat.exe >
This is an example of the driver list at the end of the output:
ModuleName Load Addr Code Data Paged linkDate
----------------------------------------------------------------------
ntoskrnl.exe 80100000 270272 40064 434816 Sun May 11 00:10:39 1997
hal.dll 80010000 20384 2720 9344 Mon Mar 10 16:39:20 1997
aic78xx.sys 80001000 20512 2272 0 Sat Apr 05 21:16:21 1997
SCSIPORT.SYS 801d7000 9824 32 15552 Mon Mar 10 16:42:27 1997
Disk.sys 80008000 3328 0 7072 Thu Apr 24 22:27:46 1997
CLASS2.SYS 8000c000 7040 0 1632 Thu Apr 24 22:23:43 1997
INO_FLPY.SYS 801df000 9152 1472 2080 Tue May 26 18:21:40 1998
Ntfs.sys 801e3000 68160 5408 269632 Thu Apr 17 22:02:31 1997
Floppy.SYS f7290000 1088 672 7968 Wed Jul 17 00:31:09 1996
Cdrom.SYS f72a0000 12608 32 3072 Wed Jul 17 00:31:29 1996
Cdaudio.SYS f72b8000 960 0 14912 Mon Mar 17 18:21:15 1997
Null.SYS f75c9000 0 0 288 Wed Jul 17 00:31:21 1996
KSecDD.SYS f7464000 1280 224 3456 Wed Jul 17 20:34:19 1996
Beep.SYS f75ca000 1184 0 0 Wed Apr 23 15:19:43 1997
cs32ba11.SYS fcd1a000 52384 45344 14592 Wed Mar 12 17:22:33 1997
msi8042.SYS f7000000 20192 1536 0 Mon Mar 23 22:46:22 1998
mouclass.sys f7470000 1984 0 0 Mon Mar 10 16:43:11 1997
kbdclass.sys f7478000 1952 0 0 Wed Jul 17 00:31:16 1996
VIDEOPRT.SYS f72d8000 2080 128 11296 Mon Mar 10 16:41:37 1997
ati.sys f7010000 960 9824 48768 Fri Dec 12 15:20:37 1997
vga.sys f7488000 128 32 10784 Wed Jul 17 00:30:37 1996
Msfs.SYS f7308000 864 32 15328 Mon Mar 10 16:45:01 1997
Npfs.SYS f7020000 6560 192 22624 Mon Mar 10 16:44:48 1997
NDIS.SYS fccda000 11744 704 96768 Thu Apr 17 22:19:45 1997
win32k.sys a0000000 1162624 40064 0 Fri Apr 25 21:17:32 1997
ati.dll fccba000 106176 17024 0 Fri Dec 12 15:20:08 1997
Cdfs.SYS f7050000 5088 608 45984 Mon Mar 10 16:57:04 1997
INO_FLTR.SYS fc42f000 29120 38176 1888 Tue Jun 02 16:33:05 1998
TDI.SYS fc4a2000 4480 96 288 Wed Jul 17 00:39:08 1996
tcpip.sys fc40b000 108128 7008 10176 Fri May 09 17:02:39 1997
netbt.sys fc3ee000 79808 1216 23872 Sat Apr 26 21:00:42 1997
el90x.sys f7320000 24576 1536 0 Wed Jun 26 20:04:31 1996
afd.sys f70d0000 1696 928 48672 Thu Apr 10 15:09:17 1997
netbios.sys f7280000 13280 224 10720 Mon Mar 10 16:56:01 1997
Parport.SYS f7460000 3424 32 0 Wed Jul 17 00:31:23 1996
Parallel.SYS f746c000 7904 32 0 Wed Jul 17 00:31:23 1996
ParVdm.SYS f7552000 1312 32 0 Wed Jul 17 00:31:25 1996
Serial.SYS f7120000 2560 0 18784 Mon Mar 10 16:44:11 1997
rdr.sys fc385000 13472 1984 219104 Wed Mar 26 14:22:36 1997
mup.sys fc374000 2208 6752 48864 Mon Mar 10 16:57:09 1997
srv.sys fc24a000 42848 7488 163680 Fri Apr 25 13:59:31 1997
Pscript.DLL f9ec3000 0 0 0
Fastfat.SYS f9e00000 6720 672 114368 Mon Apr 21 16:50:22 1997
NTDLL.DLL 77f60000 237568 20480 0 Fri Apr 11 16:38:50 1997
----------------------------------------------------------------------
Total 2377632 255040 1696384
Bazı hataların izahları
00: Divide Fault
The processor returns this exception when it encounters a divide fault. A divide fault occurs if division by zero is attempted or if the result of the operation does not fit in the destination operand.
02: NMI Interrupt
Interrupt 2 is reserved for the hardware Non-Maskable-Interrupt condition. No exceptions trap through interrupt 2.
04: Overflow Trap
The overflow trap occurs after an INTO instruction has executed and the 0F bit is set to 1.
05: Bounds Check Fault
The BOUND instruction compares the array index with an upper and lower bound. If the index is out of range, then the processor traps to interrupt 05.
06: Invalid Opcode Fault
This error is returned if any one of the following conditions exists:
- The processor tries to decode a bit pattern that does not correspond to any legal computer instruction.
- The processor attempts to execute an instruction that contains invalid operands.
- The processor attempts to execute a protected-mode instruction while running in virtual 8086 mode.
- The processor tries to execute a LOCK prefix with an instruction that cannot be locked.
07: Coprocessor Not Available Fault
This error occurs if the computer does not have a math coprocessor and the EM bit of register CR0 is set indicating that Numeric Data Processor emulation is being used. Each time a floating point operation is executed, an interrupt 07 occurs.
This error also occurs when a math coprocessor is used and a task switch is executed. Interrupt 07 tells the processor that the current state of the coprocessor needs to be saved so that it can be used by another task.
08: Double Fault
Processing an exception sometimes triggers a second exception. In the event that this occurs, the processor will issue a interrupt 08 for a double fault.
09: Coprocessor Segment Overrun
This error occurs when a floating point instruction causes a memory access that runs beyond the end of the segment. If the starting address of the floating point operand is outside the segment, then a General Protection Fault occurs (interrupt 0D).
10 (0Ah): Invalid Task State Segment Fault
Because the Task State Segment contains a number of descriptors, any number of conditions can cause exception 0A. Typically, the processor can gather enough information from the Task State Segment to issue another fault pointing to the actual problem. See Microsoft's Programming the 80386/80486 Guide for more information.
11 (0Bh): Not Present Fault
The Not present interrupt allows the operating system to implement virtual memory through the segmentation mechanism. When a segment is marked as "not present," the segment is swapped out to disk. The interrupt 0B fault is triggered when an application needs access to the segment.
12 (0Ch): Stack Fault
A Stack Fault occurs with error code 0 if an instruction refers to memory beyond the limit of the stack segment. If the operating system supports expand-down segments, increasing the size of the stack should alleviate the problem. Loading the Stack Segment with invalid descriptors will result in a general protection fault.
13 (0Dh): General Protection Fault
Any condition that is not covered by any of the other processor exceptions will result in a general protection fault. The exception indicates that this program has been corrupted in memory, usually resulting in immediate termination of the program.
14 (0Eh): Page Fault
The Page Fault interrupt allows the operating system to implement virtual memory on a demand-paged basis. An interrupt 14 usually is issued when an access to a page directory entry or page table with the present bit set to 0 (Not present) occurs. The operating system makes the page present (usually retrieves the page from virtual memory) and re-issues the faulting instruction, which then can access the segment. A page fault also occurs when a paging protection rule is violated (when the retrieve fails, or data retrieved is invalid, or the code that issued the fault broke the protection rule for the processor). In these cases the operating system takes over for the appropriate action.
16 (10h): Coprocessor Error Fault
This interrupt occurs when an unmasked floating-point exception has signaled a previous instruction. (Because the 80386 does not have access to the Floating Point unit, it checks the ERROR pin to test for this condition.) This is also triggered by a WAIT instruction if the Emulate Math Coprocessor bit at CR0 is set.
17 (11h): Alignment Check Fault
This interrupt is only used on the 80486 CPUs. An interrupt 17 is issued when code executing at ring privilege 3 attempts to access a word operand that is not on an even-address boundary, a double-word operand that is not divisible by four, or a long real or temp real whose address is not divisible by eight. Alignment checking is disabled when the CPU is first powered up and is only enabled in protected mode.
Disabling the “restart on system failure” feature may permit the exact cause to be isolated: Right-click on My Computer, click Properties, click the Advanced tab. Under “Startup & Recovery,” click Settings. Under “System Failure,” uncheck the box in front of “System reboot.”
Here are many of the PC Errors you may get and the source from which they come from
Error Error Source
100 - 199 System Board
200 - 299 Memory
300 - 399 Keyboard
400 - 499 Monochrome Display
500 - 599 Color/Graphics Display
600 - 699 Floppy-disk drive and/or Adapter
700 - 799 Math Coprocessor
900 - 999 Parallel Printer Port
1000 - 1099 alternate Printer Adapter
1100 - 1299 Asynchronous Communication Device, Adapter, or Port
1300 - 1399 Game Port
1400 - 1499 Color/Graphics Printer
1500 - 1599 Synchronous Communication Device, Adapter, or Port
1700 - 1799 Hard Drive and/or Adapter
1800 - 1899 Expansion Unit (XT)
2000 - 2199 Bisynchronous Communication Adapter
2400 - 2599 EGA system-board Video (MCA)
3000 - 3199 LAN Adapter
4800 - 4999 Internal Modem
7000 - 7099 Phoenix BIOS Chips
7300 - 7399 3.5" Disk Drive
8900 - 8999 MIDI Adapter
11200 - 11299 SCSI Adapter
21000 - 21099 SCSI Fixed Disk and Controller
21500 - 21599 SCSI CD-ROM System
CANLI DESTEK
65%
956%
2059%
2700%
