Program to analyze mini-dumps

  • Thread starter Thread starter David Gorick
  • Start date Start date
D

David Gorick

Does anyone know of any programs that will analyze MS dumps after a BSOD?
Free or otherwise.
 
Type verifier in Start Run, follow the wizard but choose All Drivers. This will slow down your computer and cause more blue screen crashes but will pinpoint what is causing the crash (if the original error message didn't). Once you fix it you rerun verifier and turn it off.

If you can't start after enabling verifier
choose Last Known Good Configuration at the Failed Boot menu (which will
start without verifier).


You will be creating a crash dump file in c:\windows\minidump every blue screen. Make sure you are set to record minidumps (Small Memory Dumps) - type it in Help to see how.

Then

If you have the XP SP2 Security Update CD (else see
http://www.microsoft.com/whdc/­devtools/debugging/symbolpkg.m­spx
)


Install symbols from <CD Drive Letter>:\SUPPORT\SYMBOLS

Download
http://www.microsoft.com/whdc/devtools/debugging/installx86.mspx

Load the crash dump file into windbg
and read what it says. You may need to tell it where the symbols are. Read it.
Type
!Analyze -v
into Windbg's command line.
(this will hopefully tell you the faulty component)

If the above is too technical then email the crash dump files to david @ mvps.org. Don't send me lots of them. Just the one from your last crash after you turn verifier on. And only one per mail.

You can look up specific details here
http://msdn.microsoft.com/library/d..._ea8b9fd0-2d81-4a04-a7ed-c1c6a80bd501.xml.asp

If it indicates faulty memory might be the cause you can get a memory tester
here
http://oca.microsoft.com/en/wi­ndiag.asp


If it mentions a core windows system file, meaning it a MS fix is required,
upload a minidump to

http://oca.microsoft.com

Also try typing the main error code in Help while online (ie,
Stop 0x50
and also try in the 8 digit form
stop 0x00000050)
and if there are too many hits use a filename if available. Generally memory
addresses are different for each computer (as each computer has a different
mix of drivers) so parameters that are memory addresses aren't that useful for searching, but NTStatus codes are (plus you can look them up here http://cvs.sourceforge.net/viewcvs.py/mingw/w32api/include/ddk/ntstatus.h?rev=1.2).

If this doesn't work try

Get your XP CD and install Windows Support Tools.


Type in start run after installing and rebooting


pstat > "%userprofile%\desktop\driverl­ist.txt"


The last table in this file is a list of loaded drivers. Other things apart
from hardware uses drivers. Post the list of drivers (the last table only -
REPEAT THE LAST TABLE O N L Y ) or match the fault address to the driver.

This will allow you to match memory addresses to a driver.
 
Thanks Greenie. A friend sent me an email late yesterday and I, without
thinking, went to where I can always find an answer. I could have googled
it myself but my brain was already in bed. Thanks again.
 
Thanks David. As always you have a great answer. I appreciate your vast
knowledge of XP and never fail to learn something new from reading your
replies to peoples questions. Keep up the great work. A lot of us depend
on you to keep us out of too much trouble.

David Gorick


"David Candy" <.> wrote in message
Type verifier in Start Run, follow the wizard but choose All Drivers. This
will slow down your computer and cause more blue screen crashes but will
pinpoint what is causing the crash (if the original error message didn't).
Once you fix it you rerun verifier and turn it off.

If you can't start after enabling verifier
choose Last Known Good Configuration at the Failed Boot menu (which will
start without verifier).


You will be creating a crash dump file in c:\windows\minidump every blue
screen. Make sure you are set to record minidumps (Small Memory Dumps) -
type it in Help to see how.

Then

If you have the XP SP2 Security Update CD (else see
http://www.microsoft.com/whdc/­devtools/debugging/symbolpkg.m­spx
)


Install symbols from <CD Drive Letter>:\SUPPORT\SYMBOLS

Download
http://www.microsoft.com/whdc/devtools/debugging/installx86.mspx

Load the crash dump file into windbg
and read what it says. You may need to tell it where the symbols are. Read
it.
Type
!Analyze -v
into Windbg's command line.
(this will hopefully tell you the faulty component)

If the above is too technical then email the crash dump files to david @
mvps.org. Don't send me lots of them. Just the one from your last crash
after you turn verifier on. And only one per mail.

You can look up specific details here
http://msdn.microsoft.com/library/d..._ea8b9fd0-2d81-4a04-a7ed-c1c6a80bd501.xml.asp

If it indicates faulty memory might be the cause you can get a memory tester
here
http://oca.microsoft.com/en/wi­ndiag.asp


If it mentions a core windows system file, meaning it a MS fix is required,
upload a minidump to

http://oca.microsoft.com

Also try typing the main error code in Help while online (ie,
Stop 0x50
and also try in the 8 digit form
stop 0x00000050)
and if there are too many hits use a filename if available. Generally memory
addresses are different for each computer (as each computer has a different
mix of drivers) so parameters that are memory addresses aren't that useful
for searching, but NTStatus codes are (plus you can look them up here
http://cvs.sourceforge.net/viewcvs.py/mingw/w32api/include/ddk/ntstatus.h?rev=1.2).

If this doesn't work try

Get your XP CD and install Windows Support Tools.


Type in start run after installing and rebooting


pstat > "%userprofile%\desktop\driverl­ist.txt"


The last table in this file is a list of loaded drivers. Other things apart
from hardware uses drivers. Post the list of drivers (the last table only -
REPEAT THE LAST TABLE O N L Y ) or match the fault address to the driver.

This will allow you to match memory addresses to a driver.
 
Back
Top