o fully analyze a memory dump.
To use the tool, follow these steps:
- Download and install the Windows Debugger from the Microsoft Web Site .
If you use Google to search for "windows debugger," the first link returned will be the Windows Debugger home page.
- Once installation completes click Start, click All Programs, click Debugging Tools for Windows, then click WinDbg to open the Windows Debugger.
- Configure the symbol path used by the debugger to turn addresses in the memory dump file into meaningful location names: expand the File menu, select Symbol File Path, type "SRV*c:\debug_symbols*http://msdl.microsoft.com/download/symbols" in the dialog box then click OK.
- Open a minidump file: expand the File menu, select Open Crash Dump, select the desired dump file and click Open.
The system usually stores minidump files in either: C:\WINNT\Minidump\ or C:\Windows\Minidump\. The files will be named miniMMDDYY-NN.dmp, where MMis the month, DD is the day, and YY is the year in which the dump file was created. NN is the sequence the dump files were created in if multiple dumps were generated on the same day (the first crash dump on a given day will be numbered 01, the second 02, etc.).
- The debugger will open the dump file and give a brief description of what caused the system to crash. (Figure 2)
The first time you use the Debugger to open and dump file on a system, it will take a few minutes to download symbol information in the background before it returns any information.
Figure 2: Windows Debugger
Suggested command for the Debugger's command line
Stop code from the blue screen (1000007F is the same as 0x7F)
What Windows thinks caused the crash (atapi.sysin this example, you will sometimes see things like memory_corruption
- When it returns this preliminary analysis, the Debugger tells you how to dig deeper. Type "!analyze -v" in the command line (kd>) field at the bottom of the window and press theEnter key to have the WinDbg perform a detailed analysis of the file.
The results will be lengthy, and you may ha