Dumpfile Debugging Guide

[imported_nocturne]

Previous guide on Random Rebooting / BSOD's

First of all, a dump file (usually) is created everytime your system experiences a serious error. The dump files are usually stored within the "\Windows\Minidump" (windows BSOD dumps) folder, but sometimes windows saves critical error dumps in the TEMP folder in your profile's 'Local Settings' folder (debugging them won't tell you much, but it will tell you what caused the problem). If you can't find them, you can find the path referenced the in event log by running 'compmgmt.msc' (look for the red X's).

Once, you've found the dump file, now you need to analyze it. First, you're going to need the MS Debugging Tools (xp64). Once installed, run the WinDBG program (linked in start menu). Now in order to debug the files, you're going to need to access the appropriate "Symbols". You can either download the whole symbols package, or you can access them over the net by using the following path (entered in under 'Symbol file path' in file menu of WinDBG) :

SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols

Now you can open the dump file using by selecting 'Open Crash Dump' under the file menu. After it loads the dump and access the symbols, now you can use the following commands to try to find the problem.

!analyze -show displays Stop error code and its parameters
!analyze -v displays bugcheck verbose output.
lm N T lists all loaded modules

Now it's up to you to be able to find the cause of the problem. Just try to look for drivers or system files referenced in the debug output, and you might find yourself closer to the source of the problem.

 

[dclive]

This is good.

The "!analyze -v" will typically point to the problem.

Bear in mind that the debugger will be useful for kernel-mode crashes (AKA BSODs), which are found in c:\windows\minidump folder, and not too useful for program crashes (found in the \user directory you mention).

 

[imported_nocturne]

Thanks for the wisdom, dclive.

I wouldn't have bothered (as my first time debugging was for this guide), but the link to your guide that I've been shamelessy referencing for monthes disappeared some time ago. Nice to see you're still around.

Could you clarify on how to properly debug program crash dumps? It seems I was able to get the one I generated to go through debug, but logically I would understand why it wouldn't work. Thanks.