From - Mon Sep 22 08:16:42 1997
Path: news.mitre.org!blanket.mitre.org!agate!howland.erols.net!news-peer.sprintlink.net!news-pull.sprintlink.net!news-in-east.sprintlink.net!news.sprintlink.net!Sprint!194.25.2.138!newsfeed00.btx.dtag.de!news.btx.dtag.de!not-for-mail
From: LP.Office@t-online.de (Sam Li)
Newsgroups: microsoft.public.win32.programmer.kernel,comp.os.ms-windows.programmer.nt.kernel-mode
Subject: Re: Blue Screen and Memory Management
Date: 19 Sep 1997 03:01:17 GMT
Organization: Cinco Networks
Lines: 37
Message-ID: <5vsptu$tge$12@news01.btx.dtag.de>
References: <34149ABF.AADD9DC9@cinco.com> <341514ed.1018414@spock>
Reply-To: samuell@cinco.com
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
X-Sender: 0751561220-0001@t-online.de (LP Elektronik GmbH)
X-Mailer: Mozilla 4.02 [en] (WinNT; I)
Xref: news.mitre.org microsoft.public.win32.programmer.kernel:698 comp.os.ms-windows.programmer.nt.kernel-mode:3598

Stephan Wolf wrote:
> 
> On Mon, 08 Sep 1997 17:39:27 -0700, Sam Li <samuell@cinco.com> wrote:
> 
> >Does anyone know how to relate the stack dump on NT blue screen
> >to either MAP file or anything?  I tried to use the base address
> >of the module and add the offset from the module's map file.  But,
> >it doesn't match.
> 
> AFAIK, you would have to add some fix offset also, because a module's
> "base" address is actually not the base of the function offsets that
> you see in the map file.
> 
> As an alternative, add either "/CRASHDEBUG" or "/DEBUGPORT=COM1" (or
> COM2) to your "boot line" in BOOT.INI. Then connect a debugger, i.e.
> either WinDbg or the Kernel Debugger, via a serial line and load the
> symbols. The symbol files are on the NT CD in directory
> \SUPPORT\DEBUG\%Cpu%\SYMBOLS. Copy them to %SystemRoot%\SYMBOLS.
> (%Cpu% and %SystemRoot% are environment variables.)
> 
> After the machine has bugchecked (blue screen) you can then easily get
> a stack trace via the "k" command (kb, kv, etc.). Then simply use the
> "u" command with the return address(es) (minus e.g. 0x20 or so) you
> see on the stack (second column).

Thanks a lot for your help.  

I am using WinIce intead of WinDbg.  Is any other way I can find
the information?

-Sam


> 
> Stephan Wolf <swolf@syskonnect.de> http://www.syskonnect.de
> SysKonnect - The Server Connectivity Company