Sep 20 2004, 11:51 AM, updated 20y ago
analyze Minidump a.k.a Crash Dump
1.Download and install Microsoft Windows Debugger (WinDbg) from
http://www.microsoft.com/whdc/devtools/deb...installx86.mspx
2.Run WinDbg.
3.Before analyze the minidump, you need to setup "Symbol File Path".
a.File -> Symbol File Path -> type
"SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols"
(without quotes) to the text box.
b.Check the Reload check box and click OK.
4.Now you can open a crash dump for analysis.
a.File -> Open Crash Dump.
b.Open a minidump file that you would like to analyze.
c.After you have opened a minidump file,
system will ask you to save "Base Workspace Information" and just click YES.
5.Now the debugger is analyzing your dump file and please waits...
6.If you see this screen, you can type "!analyze -v" in the kd> text box
and press ENTER.
7.After analyze -v operation is completed, the process of dump analysis is DONE
and you can find the crash information here.
8.This is the result:
Microsoft ® Windows Debugger Version 6.3.0017.0
Copyright © Microsoft Corporation. All rights reserved.
Loading Dump File [C:\WINDOWS\Minidump\Mini091904-04.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp2_rtm.040803-2158
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055ab20
Debug session time: Sun Sep 19 23:34:08 2004
System Uptime: 0 days 0:15:39.343
Loading Kernel Symbols
..........................................
Loading unloaded module list
....................
Loading User Symbols
****************************************************************
* *
* Bugcheck Analysis *
* *
****************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 10000050, {ac191633, 0, ac191633, 0}
Could not read faulting driver name
Probably caused by : win32k.sys ( win32k!IsRestricted+5 )
Followup: MachineOwner
---------
kd> .reload
Loading Kernel Symbols
..........................................
Loading unloaded module list
....................
Loading User Symbols
kd> !analyze -v
****************************************************************
* *
* Bugcheck Analysis *
* *
****************************************************************
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: ac191633, memory referenced.
Arg2: 00000000, value 0 = read operation, 1 = write operation.
Arg3: ac191633, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 00000000, (reserved)
Debugging Details:
------------------
Could not read faulting driver name
READ_ADDRESS: ac191633
FAULTING_IP:
+ffffffffac191633
ac191633 ?? ???
MM_INTERNAL_CODE: 0
CUSTOMER_CRASH_COUNT: 4
DEFAULT_BUCKET_ID: COMMON_SYSTEM_FAULT
BUGCHECK_STR: 0x50
LAST_CONTROL_TRANSFER: from bf8dc034 to ac191633
STACK_TEXT:
WARNING: Frame IP not in any known module. Following frames may be wrong.
ed332c14 bf8dc034 bf83ad9d 824ae420 e478aab8 0xac191633
ed332c84 bf83b0b7 0364a780 00000000 00000001 win32k!IsRestricted+0x5
ed332ca0 bf801a55 00000000 00000001 00000000 win32k!xxxCallHook+0x26
ed332ce8 bf80365e ed332d14 000025ff 00000000 win32k!xxxRealInternalGetMessage+0x264
ed332d48 804df06b 052fec5c 00000000 00000000 win32k!NtUserPeekMessage+0x40
ed332d48 7c90eb94 052fec5c 00000000 00000000 nt!KiFastCallEntry+0xf8
052febdc 00000000 00000000 00000000 00000000 0x7c90eb94
FAILED_INSTRUCTION_ADDRESS:
+ffffffffac191633
ac191633 ?? ???
FOLLOWUP_IP:
win32k!IsRestricted+5
bf8dc034 51 push ecx
SYMBOL_STACK_INDEX: 1
FOLLOWUP_NAME: MachineOwner
SYMBOL_NAME: win32k!IsRestricted+5
MODULE_NAME: win32k
IMAGE_NAME: win32k.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 41107f7a
STACK_COMMAND: kb
BUCKET_ID: 0x50_CODE_AV_BAD_IP_win32k!IsRestricted+5
Followup: MachineOwner
---------
9.In this example, the error is PAGE_FAULT_IN_NONPAGED_AREA (50).
You can copy the exact error and search the related info from www.google.com.
This is the website that I found to tell you what this error is about.
http://www.dslreports.com/forum/remark,109...e=flat~start=20
10.The error that I got is related to MEMORY_CORRUPTION.
11.I have downloaded a memory test tool called MEMTEST86 from http://www.memtest86.com/memt31a.zip.
Please follow the guideline for how to create bootable CD and use the tool.
12.I have ran the test for my memory and found a lot of error in my 2nd slot Kingston KVR333X64C25/256.
Now I will bring my faulty memory and the test result for my memory warranty.
~ Good Luck & Happy Analyzing ~
This post has been edited by samurai1337: Nov 30 2006, 07:23 AM
Quote
dont know how to make new folder in C: 
0.0201sec
0.37
7 queries
GZIP Disabled