Mfartura's blog - All Comments

re: Tip: Kernel Debugging a VPC Server

KnowALittle — Mon, 20 Feb 2012 01:37:05 GMT

I did all of the steps and STILL it does not connect. Can you be more detailed about step 4. Maybe that is where I did it wrong.You state "reboot the VPC image" how do you EXACTLY do this in the virtual machine? In my case I am using Windows Virtual XP Mode.

re: Real Case: Random apps running 100% CPU (advanced)

VOXLEO — Tue, 30 Aug 2011 08:33:34 GMT

THANK YOU. I have been having this issue for YEARS now and thought I had a trojan or virus or something. And even though the last bit of programming I studied was turbo pascal back around 1986, I actually followed that explanation well enough to understand what was probably going on by the time I read:

"shl edx,8

It will make a shift left on the EDX value of 8 positions. EDX is a 32-bit representation of the value 0x0, so shifting it 8 positions wouldn’t change anything. EDX remains 0x0 after the operation..."

Actually started to LOLwhen I got to "Now hold on..." Well done.

Can't believe this hasn't been remedied by Nvidia... Looks like I'll go with ATI instead next time...

re: /3GB, /PAE, AWE what??? (basic)

'Enthiran' Shankar — Thu, 25 Aug 2011 05:12:03 GMT

Wow, i am amazed by this fantabulous article ! awesome ! Great work keep it up ,,..

re: Kernel dump analysis - Bugcheck 0xA (IRQL_NOT_LESS_OR_EQUAL)

serge tyssen — Thu, 02 Jun 2011 05:52:06 GMT

I had the exact same problem on <a href="www.articlewritingclicks.com/.../a> on a McAffee Internet Security version.I switched to another antiv and it never came back.I wonder if they know about it?

re: /3GB, /PAE, AWE what??? (basic)

'aadukalam' Vetrimaran — Thu, 27 Jan 2011 19:12:05 GMT

Wow., it looks great and its useful too !

re: Real Case: Random apps running 100% CPU (advanced)

Neil — Fri, 24 Sep 2010 14:39:00 GMT

Yes - same problem - happening on a Win2003 machine. Putting up with this for the past 3 or so years. NVidia says I have the latest drivers. :(

re: Real Case: Random apps running 100% CPU (advanced)

Johann Stegmann — Wed, 11 Aug 2010 07:47:07 GMT

Absolutely right.-.

even 4 y after .. you can guess?-- that bug still excists..

landed here after all .. Thx a lot Marcelo Fartura..

You saved me an long eve with Maths :)

re: /3GB, /PAE, AWE what??? (basic)

Cuba Real Estate — Wed, 04 Aug 2010 13:35:58 GMT

This is quite interesting, good to know and to try, i'll check my apps for compliance. thanks

Fique por dentro Fartura » Blog Archive » Mfartura's blog : Logparser fails when using the ChartType option

Mon, 25 May 2009 05:56:01 GMT

PingBack from http://fiquepordentro.net/fartura/2009/05/13/mfarturas-blog-logparser-fails-when-using-the-charttype-option/

re: Kernel dump analysis - Bugcheck 0xA (IRQL_NOT_LESS_OR_EQUAL)

n-rico — Mon, 09 Mar 2009 14:29:18 GMT

Hello Marcelo,

I am trying to apply your debugging steps to a few 0xA dumps we have had over the last few weeks, all were 'probably caused' by TDI.sys. (so I'm guessing something network related)

The last function called before the stack was: hal!KeAcquireSpinLockRaiseToSynch+0xe

Any tips on further analyzing this problem? I really find this stuff interesting but I'm guessing I would have to aquire some Assembler knowledge to be able to debug these kind of issues :S

# ChildEBP RetAddr Args to Child

00 b7104a04 80a5a3de badb0d00 00000000 80a5da73 nt!KiTrap0E+0x2a7 (FPO: [0,0] TrapFrame @ b7104a04)

01 b7104a74 b4bb1b6c b7104ae0 8ab6ae48 00000000 hal!KeAcquireSpinLockRaiseToSynch+0xe (FPO: [0,0,0])

02 b7104a8c b4bb750d 89351002 00000000 00000029 tcpip!TCPDataRequestComplete+0x40 (FPO: [Non-Fpo])

03 b7104aac b4bb74ad b7104ae0 00003700 88e3e1a8 tcpip!CompleteSends+0x31 (FPO: [Non-Fpo])

04 b7104aec b4bb6cbc 00000029 3b806af8 8c51e700 tcpip!TcpFastReceive+0x390 (FPO: [Non-Fpo])

05 b7104bc8 b4bb32bf 8cb63f48 0100007f 0100007f tcpip!TCPRcv+0x723 (FPO: [Non-Fpo])

06 b7104c28 b4bb14de 00000024 8cb63f48 b4bb6a6d tcpip!DeliverToUser+0x189 (FPO: [Non-Fpo])

07 b7104cb8 b4bbd163 8cb63f48 b7104d30 00000014 tcpip!IPRcvPacket+0x686 (FPO: [Non-Fpo])

08 b7104d64 f7658064 b4bf2ee0 8cb63f48 8cf50660 tcpip!LoopXmitRtn+0x195 (FPO: [Non-Fpo])

09 b7104d80 8088043d 8cb63f48 00000000 8cf50660 TDI!CTEpEventHandler+0x32 (FPO: [Non-Fpo])

0a b7104dac 80949b7c b4bf2ee0 00000000 00000000 nt!ExpWorkerThread+0xeb (FPO: [Non-Fpo])

0b b7104ddc 8088e062 80880352 00000001 00000000 nt!PspSystemThreadStartup+0x2e (FPO: [Non-Fpo])

0c 00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16

3: kd> .trap b7104a04

ErrCode = 00000002

eax=00000002 ebx=00000000 ecx=00000026 edx=00000000 esi=89351040 edi=00000002

eip=80a5a3de esp=b7104a78 ebp=b7104a8c iopl=0 nv up ei pl nz na po nc

cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010202

hal!KeAcquireSpinLockRaiseToSynch+0xe:

80a5a3de f00fba2900 lock bts dword ptr [ecx],0 ds:0023:00000026=????????

Sincerely,

Enrico Klein