Analysing a Crash Dump-Basics

One of the worst experiences we can have while working on Windows is the BSOD or Blue Screen of Death. Its also a difficult assignment for the support professionals to investigate these issues. Debugging crash dumps requires extensive knowledge about Memory Management and other Windows System internal concepts.


However there is something that pretty much every one can do to analyse a crash dump in its simplest form. If you are lucky enough then most of the issues can be solved by this simple step.


All that you need is install the Debugging tools for Windows.


You can download this tool from the following location (for Windows XP) : http://msdl.microsoft.com/download/symbols/debuggers/dbg_x86_6.11.1.404.msi

Once Installed, the first thing you need to do is add the Microsoft symbol server path. Follow the below steps


Go to "ALL Programs"-->Debugging Tools for Windows and then select WinDbg.

Select the File Menu-> and then Select Symbol File Path





Add the path : SRV*C:\Symbols*http://msdl.microsoft.com/download/symbols and then hit OK





Now, the configuration part is over now you need to open the crash dump in the debugging tool.


Go to File menu and then select Open Crash dump--> Point to the location where the crash dump is saved in explorer and select the file. By default system crash dumps will be saved under %SystemRoot%\Minidump folder.






Once the dump file is loaded, you need to wait for some time for the debugger to download the symbol files. Once the symbol files are downloaded the debugger will look something similar to below screen shot




Just click on the ! analyze -v link and debugger will let you know the possible driver that has caused the crash. In the example below, the crash was caused by igxpmp32.sys file which is the file related to Intel Graphics driver.





BSOD issues are often caused by faulty or outdated drivers and you can solve these issues by looking for an updated driver in the corresponding vendor site.