2003 sp2

使用livekd出现问题，提示信息如下：

Microsoft (R) Windows Debugger  Version 6.6.0007.5
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\WINDOWS\system32\livekd.dmp]
Kernel Complete Dump File: Full address space is available

Comment: 'LiveKD live system view'
Symbol search path is: srv*D:\symbols\2003sp2*909K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8X3#2K6k6r3I4Q4x3X3g2E0K9h3y4J5L8%4y4G2k6Y4c8Q4x3X3g2U0L8$3#2Q4x3V1k6V1L8%4N6F1L8r3!0S2k6q4)9J5c8Y4y4&6L8h3u0G2L8s2x3`.
Executable search path is:
Windows Server 2003 Kernel Version 3790 (Service Pack 2) MP (2 procs) Free x86 compatible
Product: Server, suite: Enterprise TerminalServer SingleUserTS
Built by: 3790.srv03_sp2_rtm.070216-1710
Kernel base = 0x80800000 PsLoadedModuleList = 0x808a6ea8
Debug session time: Sun Feb 13 10:34:57.897 17420 (GMT+8)
System Uptime: 0 days 1:17:24.210
WARNING: Process directory table base 7D1084C0 doesn't match CR3 7D108380
WARNING: Process directory table base 7D1084C0 doesn't match CR3 7D108380
Loading Kernel Symbols
.......................................................................................................................
Loading User Symbols
..............................
Loading unloaded module list
.............
*** ERROR: Module load completed but symbols could not be loaded for LiveKdD.SYS
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 0, {0, 0, 0, 0}

Probably caused by : LiveKdD.SYS ( LiveKdD+12d1 )

Followup: MachineOwner
---------

执行!analyze -v

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Unknown bugcheck code (0)
Unknown bugcheck description
Arguments:
Arg1: 00000000
Arg2: 00000000
Arg3: 00000000
Arg4: 00000000

Debugging Details:
------------------

PROCESS_NAME:  windbg.exe

FAULTING_IP:
LiveKdD+12d1
b925b2d1 eb30            jmp     LiveKdD+0x1303 (b925b303)

EXCEPTION_RECORD:  ffffffff -- (.exr ffffffffffffffff)
ExceptionAddress: b925b2d1 (LiveKdD+0x000012d1)
   ExceptionCode: 80000003 (Break instruction exception)
  ExceptionFlags: 00000001
NumberParameters: 0

ERROR_CODE: (NTSTATUS) 0x80000003 - {

DEFAULT_BUCKET_ID:  STATUS_BREAKPOINT

BUGCHECK_STR:  0x0

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from b4ae7d40 to b925b2d1

STACK_TEXT:  
WARNING: Stack unwind information not available. Following frames may be wrong.
b4ae7c5c b4ae7d40 00000000 8088dace b4ae7ca4 LiveKdD+0x12d1
00000000 00000000 00000000 00000000 00000000 0xb4ae7d40

STACK_COMMAND:  kb

FOLLOWUP_IP:
LiveKdD+12d1
b925b2d1 eb30            jmp     LiveKdD+0x1303 (b925b303)

SYMBOL_STACK_INDEX:  0

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: LiveKdD

IMAGE_NAME:  LiveKdD.SYS

DEBUG_FLR_IMAGE_TIMESTAMP:  42deb1e0

SYMBOL_NAME:  LiveKdD+12d1

FAILURE_BUCKET_ID:  0x0_LiveKdD+12d1

BUCKET_ID:  0x0_LiveKdD+12d1

Followup: MachineOwner
---------

究竟是咋回事？

[培训]科锐逆向工程师培训第53期2025年7月8日开班！