Buzz
When a Windows application crashes or suddenly stops working, a "crash dump file" is created to store the current information just before the failure occurs. You can troubleshoot the cause of the issue by reading the memory dump file. A free tool called "BlueScreenView" can help detect errors quickly, or you can use the Windows Debugger tool to gather detailed information.
Steps
Using BlueScreenView
Use BlueScreenView if you only need to identify the cause of the error. Most users only need the dump file to find out what caused the application to stop or the blue screen issue. BlueScreenView is a free utility from NirSoft that analyzes dump files to pinpoint which driver or component is responsible for the failure.
- The file created during a system error is called a "minidump."
Download BlueScreenView. You can download BlueScreenView directly from NirSoft at nirsoft.net/utils/blue_screen_view.html.
- You can download the program separately in ZIP format. The program can be run without installation. After downloading the ZIP file, right-click and choose "Extract" to create a new folder containing the BlueScreenView program.
Launch BlueScreenView. After extracting BlueScreenView from the ZIP file, launch the program from the folder. Windows will prompt you to continue.
Locate the dump file you want to analyze. When your computer encounters an error, a "minidump" file will be created in the Windows folder. These files have a .dmp extension, and BlueScreenView can read and analyze them for you. You can find the Minidump file at C:\Windows\Minidump. If you can't find the file, you need to adjust your settings to display hidden files:
- On Windows 10 and 8, click the "View" tab in Windows Explorer and check the "Hidden items" checkbox.
- On Windows 7 and earlier, open Folder Options in Control Panel, click the "View" tab, and then select "Show hidden files, folders, and drives".
Drag the .dmp file into the BlueScreenView window. The quickest way to open a .dmp file is by dragging it into the window. The file will not be moved from its original location. The bottom of the BlueScreenView window will display the data after dragging the file into the program window.
Find the "Caused By Driver" column in the first entry. You may need to scroll down to find this column. This column shows the driver that caused the system error.
- You can find the problematic driver highlighted in red at the bottom of the window. Double-click the highlighted entry to view details: product name, description, and path.
Use this information to resolve the issue. Now that you know which driver is causing the problem, you can proceed with the fix. Try searching online with the keyword "driver name causing issues" to find experiences from others who have encountered similar problems.
Using WinDBG
Use this method for a deeper analysis. Most people do not need to use the Windows Debugger to open the MEMORY.DMP file to identify the faulty memory code when a system error occurs. However, if you want to understand how Windows utilizes drivers and memory, or if you wish to analyze dump files for development purposes, Windows Debugger can provide you with valuable insights.
Download the Windows Software Development Kit (WDK). This program includes WinDBG, which you will use to open the dump file. You can download the WDK installer here.
Run the sdksetup.exe file. This will start the installation process. Skip the initial screens and keep the default settings.
Uncheck everything except for "Debugging Tools for Windows." You can deselect all other unnecessary features when opening the dump file. This will help save installation time and disk space.
Wait for the file to download and install. This process may take a few minutes.
Open Command Prompt as Administrator. You need to open Command Prompt to link the .dmp file to WinDBG, so the program can analyze the file. Launch Command Prompt from the "system32" directory.
- Windows 10 and 8 - Right-click the Windows button and select "Command Prompt (Admin)."
- Windows 7 - Open the Start menu and type cmd. Press Ctrl+⇧ Shift+↵ Enter.
Navigate to the debugger folder. Enter the following command to switch to the correct directory. If you're using Windows 10, you can copy and paste the command. For older versions, you'll need to type it manually:
- cd\Program Files (x86)\Windows Kits\8.1\Debuggers\x64\
Enter the command to link to the dump file. Type the following command to link WinDBG to the .dmp file. Windows 10 users can copy and paste this command:
- windbg.exe -IA
- If the command is entered correctly, a blank WinDBG window will appear, which you can then close.
Launch WinDBG. You need to configure WinDBG to load the correct file from Microsoft in order to open the .dmp file. You will need to take action when opening WinDBG.
- The quickest way to start the program is by pressing ⊞ Win and typing "windbg."
Click on "File" and select "Symbol File Path". This action will open a new window.
Copy and paste the following address. This path will instruct WinDBG to download the necessary symbols from Microsoft and store them in C:\SymCache:
- SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
- The folder C:\SymCache will grow as you open dump files and download additional symbols from Microsoft.
Locate the dump file you wish to analyze. The (.dmp) file is created during system errors. By default, you can find them in the C:\Windows\Minidump folder after restoring the system. The file might also be located in C:\Windows\MEMORY.DMP. If you cannot find the file, you need to adjust settings to show hidden files:
- On Windows 10 and 8, click on the "View" tab in Windows Explorer and uncheck the "Hidden items" box.
- On Windows 7 and earlier, open Folder Options in the Control Panel, click the "View" tab, then select "Show hidden files, folders, and drives".
Double-click the dump file. As long as you have configured WinDBG according to the steps above, WinDBG will launch and begin processing the file.
Wait for the dump file to load. If this is the first time opening the dump file, you will need to wait for the symbols to load from Microsoft. Do not interfere while WinDBG is loading the file.
- Subsequent attempts will load the dump file faster because the symbols are stored in the C:\SymCache directory.
- When you see Followup: MachineOwner at the end of the dump file, it indicates the file has finished loading.
Search for the line "Probably caused by". This is the quickest way to pinpoint the root cause of the issue. WinDBG will analyze the dump file and report which driver or process is responsible for the problem. You can use this information to fix the issue or investigate further.
Find the BugCheck code. The dump file will respond with a code corresponding to each system error. Look for the code immediately under the "Probably caused by" line. You'll see a two-character code, such as "9F".
- Visit Microsoft Bug Check Code Reference to find the BugCode matching the two-character code from the list.
