How to read a MiniDump file

Posted on by

http://www.memecode.com/docs/minidump.php

If you havn’t already turned on minidumps, go to the Control Panel and follow this steps:

  1. System Icon
  2. Advanced Tab
  3. Startup and Recovery -> Settings
  4. Enable Write an Event to the system log
  5. Disable Automatically Restart
  6. Select the following debugging information:
    • Small memory dump (64 Kb)
    • Small Dump Directory : %SystemRoot%\Minidump
  7. Confirm all and restart the computer.

Install Tools
1) If you haven’t got the windows debugging tools installed, then install the Microsoft Debugging Tools.
2) Also Use the Microsoft Symbol Server to obtain debug symbol files http://support.microsoft.com/?kbid=311503 or http://www.microsoft.com/whdc/devtools/debugging/symbolpkg.mspx#d

Analyze
Either use
windbg.exe
Select Symbol File Path from File menu
Drag minidump files to program
Click Blue underlined text
OR the following
  1. Open a command prompt (Start -> Run -> “cmd”)
  2. cd \program files\debugging tools [OR c:\program files (x86)\windows kits\10\debuggers\x64]
  3. kd -z C:\WINDOWS\Minidump\Mini???????-??.dmp
  4. kd> .logopen c:\debuglog.txt
  5. kd> .sympath srv*c:\symbols*http://msdl.microsoft.com/download/symbols
  6. kd> .reload;!analyze -v;r;kv;lmnt;.logclose;q
  7. You now have a debuglog.txt in c:\, open it in a text edit (Notepad?)

Post Mortem
Look for the MODULE_NAME and IMAGE_NAME headings. This is the program that caused the error. Sometimes when it’s a device driver it means that that device is causing the BSOD and by disabling it or updating the driver your system will run stable. If you don’t know what device that name relates to then Google it.

Also look at PROCESS_NAME:
“While your minidump crashes at ntoskrnl.exe, it references mcinsupd.exe as the owning process.”
Quote from http://www.techspot.com/vb/topic56199.html

How to read miniDump File
http://blogs.technet.com/b/brad_rutkowski/archive/2006/09/09/455032.aspx
https://blogs.technet.microsoft.com/brad_rutkowski/2006/09/09/my-machine-keeps-bluescreening-how-can-i-look-at-the-dump/

 

Symbols

https://msdn.microsoft.com/en-us/library/windows/desktop/ee416588(v=vs.85).aspx

https://developer.microsoft.com/en-us/windows/hardware/download-symbols

 

http://nirsoft.net/ – bluescreenview

TRY
at KD prompt type
lmvm xxx (where xxx is the module_name that is causing the problem. It should return info on the file)

Leave a comment