Reading of memory dump files
Posted by Allen on February 27th, 2010When Windows crashes a small memory dump file records the smallest set of useful information that may help identify why your computer has stopped unexpectedly the file can be found here c:\windows\minidump\.
This dump file type includes the following information:
The Stop message and its parameters and other data
A list of loaded drivers
The processor context (PRCB) for the processor that stopped
The process information and kernel context (EPROCESS) for the process that stopped
The process information and kernel context (ETHREAD) for the thread that stopped
The Kernel-mode call stack for the thread that stopped
The small memory dump file can be useful when hard disk space is limited. However, because of the limited information that is included, errors that were not directly caused by the thread that was running at the time of the problem may not be discovered by an analysis of this file.
Tools to read the small memory dump file
You can load small memory dump files by using the Dump Check Utility (Dumpchk.exe). You can also use Dumpchk.exe to verify that a memory dump file has been created correctly. The Dump Check Utility does not require access to debugging symbols. The Dump Check Utility is included with the Microsoft Windows 2000 Support Tools and the Microsoft Windows XP Support Tools.
Install the debugging tools
To download and install the Windows debugging tools, visit the following Microsoft Web site:
http://www.microsoft.com/whdc/devtools/debugging/default.mspx (http://www.microsoft.com/whdc/devtools/debugging/default.mspx)
Select the Typical installation. By default, the installer installs the debugging tools in the following folder:
C:\Program Files\Debugging Tools for Windows
Open the dump file
To open the dump file after the installation is complete, follow these steps:
Click Start, click Run, type cmd, and then click OK.
Change to the Debugging Tools for Windows folder. To do this, type the following at the command prompt, and then press ENTER:
cd c:\program files\debugging tools for windows
To load the dump file into a debugger, type one of the following commands, and then press ENTER:
windbg -y SymbolPath -i ImagePath -z DumpFilePath
kd -y SymbolPath -i ImagePath -z DumpFilePath
Recent Comments