Menu
homeTechnique

Where are the dump files located? Crash dump

When a catastrophic error occurs, Windows OS notifies its user about the incident with various sound and text signals. Thanks to them, you can find out more specifically about the error and fix it. However, in most cases, PC owners do not remember them or simply do not know what they mean. The system, on the contrary, takes an emergency snapshot of the error, better known as a dump, and stores it on the hard drive. It contains all the information about the breakdown.

Dump types

There are three types of dump:

  1. Full is the entire contents of RAM. It is rarely used, since its size is the full amount of RAM + 1 MB of header.
  2. A core dump is information that relates exclusively to the operation of the kernel and its state.
  3. A small dump is a snapshot that contains information: the error code, its parameters, a list of drivers that were loaded into the OP at the time of the system crash. That is, the information that is sufficient to determine the cause of the failure.

In order for the system to save a small dump, it is necessary to set certain parameters.

For Windows 7 and Windows XP

Click “Start”, right-click “Computer” and select “Properties”.

Go to the “Advanced system settings” section.

The System Properties window appears. In the “Advanced” tab, in the “Boot and Recovery” section, click “Options”.

Select “Small memory dump” and click “Ok” to save the changes.

Analyzing a Small Dump Using Blue Screen View

Blue Screen View program does not require installation. In order to use it to determine the cause of the system failure, we perform the following steps.

We launch an application in the archive that is identical to the name of the program.

A software window will open. The interface is simple, however, in English. First of all, we indicate the location for saving the small dump. Click “Options” and select “Advanced Options”.

Place a checkmark next to the first section “Load from the following Mini Dump folder” and indicate the folder where the error snapshot is located. If a small dump was initially set in the system settings, the program itself will indicate the path to the snapshot C:\WINDOWS\Minidump. Click “Ok” to get to the program interface.

The block numbered 1 is a list of crash dumps that were made by the system. Under number 2 there are pictures and a list of drivers.

Drivers that cause system failure are indicated in pink in the list.

If you do not have a list of drivers, click “Options”. Go to “LowerPaneMode” and select “OnlyDriversFoundInStack”.

Having determined which driver failed, we fix the problem.

How often do you see the Windows Screen of Death (BSoD)? BSoD can occur in different cases: both while working with the system, and during the loading of the operating system. How to determine what causes BSoD and fix this problem? The Windows operating system is capable of storing a memory dump when an error occurs so that the system administrator can analyze the dump data and find the cause of the BSoD.

There are two types of memory dumps - small (minidump) and full. Depending on the operating system settings, the system may save full or small dumps, or take no action when an error occurs.

A small dump is located along the path %systemroot%\minidump and has a name like Minixxxxxx-xx.dmp
The full dump is located along the path %systemroot% and has a name like Memory.dmp

To analyze the contents of memory dumps, you should use a special utility - Microsoft Kernel Debugger.
You can get the program and components necessary for its operation directly from the Microsoft website - Debugging Tools

When choosing a debugger, you should take into account the version of the operating system on which you will have to analyze memory dumps. For a 32-bit OS, the 32-bit version of the debugger is required, and for a 64-bit OS, it is preferable to use the 64-bit version of the debugger.

In addition to the Debugging Tools for Windows package itself, you will also need a set of debugging symbols - Debugging Symbols. The set of debugging symbols is specific to each OS on which the BSoD was recorded. Therefore, you will have to download a set of symbols for each OS whose operation you will have to analyze. A 32-bit Windows XP will require the Windows XP 32-bit character set; a 64-bit OS will require the Windows XP 64-bit character set. For other operating systems of the Windows family, character sets are selected according to the same principle. You can download debugging symbols from here. It is recommended to install them at %systemroot%\symbols

After installing the debugger and debug symbols, launch the debugger. The debugger window after launch looks like this.

Before analyzing the contents of the memory dump, you will need to do a little configuration of the debugger. Specifically, tell the program where to look for debugging symbols. To do this, select from the menu File > Symbol File Path... Click the Browse... button and indicate the folder in which we installed the debugging symbols for the memory dump in question.

You can request information about the required debugging symbols directly over the Internet, from a public Microsoft server. This way you will have the latest version of the symbols. You can do this as follows - in the File > Symbol File Path… menu, enter: SRV*%systemroot%\symbols*http://msdl.microsoft.com/download/symbols

After specifying the path to the debug symbols, select File > Save workspace from the menu and confirm the action by clicking OK.

To begin analyzing the memory dump, select File > Open Crash Dump... from the menu and select the file required for examination.

The system will analyze the content, after which it will produce a result about the suspected cause of the error.

The !analyze -v command given to the debugger on the command line will output more detailed information.

You can stop debugging by selecting the menu item Debug > Stop Debugging

Thus, using the Debugging Tools for Windows package, you can always get a fairly complete picture of the causes of system errors.

Sometimes even the smallest adjustment in optimizing the Windows XP system can have a beneficial effect on the operation of the entire system. This optimization is especially valuable after you first received a “black mark” - BSOD (Blue Screen of Death). What happens when the Blue Screen of Death appears? Some strange “crazy words” are running across the monitor, the meaning of which is not clear even to experienced users. It is at this moment that a “MEMORY DUMP” is created, a very good tip for optimizing Windows XP.

What is a memory dump and how to close it?

A memory dump is a recording of your PC's RAM onto the hard drive. The contents of this file may be of any interest only to a special caste of users - programmers. But for a “dummies” such a file is of absolutely no interest, which means it is simply not needed. Therefore, the memory dump function can be disabled with a clear conscience. By the way, in this way you will free your hard drive from unnecessary records and reduce loading time. Let's move on to the algorithm for closing a memory dump. So!

We perform the following steps:

  1. Click on the “Start” button (not the start of the computer, but the virtual button located at the bottom left of the screen);
  2. RIGHT click on “My Computer” and select “Properties” in the window that opens;
  3. The “System Properties” tab will open, where we are interested in the “Advanced” section;
  4. in this section, select the bottommost item “Download and Recovery” and click the word “Options”;
  5. A section called “Download and Recovery” will open. We look and select the item “Record debugging information” (it is highlighted in blue) and select “Absent” from the drop-down list;
  6. Click on “OK”.

Briefly and clearly. Even if you don’t fully understand everything yet, it doesn’t matter: understanding comes with time and experience. And today you have taken the first small step in mastering the deeper principles of the computer system. And let this lesson seem too simple to some, but all those who now consider themselves more or less advanced users themselves started from scratch.

I am sure that a very large number of people who use a computer know very well what a blue screen, BSoD error or screen of death is. But, at the same time, I am sure that almost no one knows that in addition to displaying an error on the screen, the system also leaves an additional report in the form dump file. It is with its help that you can easily determine what exactly is causing the system failure and the appearance of a blue screen.

Therefore, right now I want to talk about these files, or rather about how and how to open a dump file, so that without problems and quickly we could not only identify but also overcome the problem with the BSoD screen.

Open dump files to determine the source of the problem

In fact, most often system administrators who repair computers and laptops turn to dump files. But sometimes even the most ordinary users who are simply trying to restore their operating system on their own may need this.

To view a dump file, of course, we will need a third-party utility, since, unfortunately, in the native resources of Windows operating systems, the ability to open dump files for analysis was not provided by Microsoft developers.

But, despite the fact that by default Windows does not have pre-installed utilities for viewing dump files, Microsoft still released a program called Debugging Tools for Windows, but in my opinion, it is not very convenient. Therefore, I decided to show how to open a dump file using another simpler and definitely no less useful program called BlueScreenView.

You may be asking why this particular program and not some other? Yes, you are right, there are a sufficient number of similar utilities. But when I first started working with dumps, this was my first program with which I opened a dump file and fixed the blue screen problem. And since it suited me in everything, I still use it.

How to open and view DUMP files using BlueScreenView

So, let's download BlueScreenView and run it on the computer. By the way, one of the advantages of why I chose this utility to view dump files is that it does not need to be installed on the computer, since it is portable, which allows you to run BlueScreenView without first installing it on the computer.

Well, when you launch the program, the utility interface will appear in which you can immediately see all possible dump files that were previously saved on the computer. Or rather, those that are in the folder C:\Windows\MiniDump, which was originally intended specifically for saving files of this type. Thus, the default setting in BlueScreenView is to search for dump files in this directory. If desired or necessary, you can change this path by simply clicking on the first icon, which is located next to the save icon.

But, let's return to the opened dump reports. On the initial screen you can see information about when the file was created, at what time, and of course, brief information directly about the error codes.

By double-clicking on one of the selected files you can get more detailed information about the reason for the operating system failure. For example, you will find out which driver caused the blue screen, as well as the name of the driver manufacturer, its version, etc.

Perhaps nothing will be clear to you from this report, but the true purpose of this article is that, in the event of a blue screen, you could, guided by a clear example, open a dump file and take a screenshot of its report, and I, in turn, would help you with it figure out.

One of the most common Windows failures is system exceptions, which the user sees in the form of a “blue screen of death” (BSOD). As a rule, this fatal error occurs either due to a malfunction of drivers, hardware (usually when loading the OS) or due to the action of viruses and antiviruses.

The blue screen of death contains information about the reasons that caused the exception (in the form of a STOP error code of the form 0x0000007b), memory addresses that were accessed when an exception occurred, and other useful information. Such information is called a STOP error, the variable parameters of which are precisely memory addresses. Sometimes it also contains the name of the file that caused the exception.

All this information is not displayed on the screen for long (up to 100 seconds), after which the computer reboots. During this short time, as a rule, a memory dump is generated and written to a file. One of the important professional methods for diagnosing failures is memory dump analysis, which will be discussed in detail in this article.

What is a dump

  • dump (English) – garbage heap; dump; hole; slum.
  • dump (memory dump) – 1) dump, outputting the contents of RAM to print or screen; 2) a “snapshot” of RAM; data obtained as a result of dumping; 3) emergency removal, shutdown, reset.
  • dumping – dumping, dump removal.

Settings for saving a memory dump are stored in the Windows system registry.

Information about the memory dump in the system Registry:

In the Windows Registry section, a crash dump is defined by the following parameters:

– REG_DWORD parameter AutoReboot with the value 0×1 (option Automatically reboot the auxiliary window Boot and Restore of the System Properties dialog box);

– REG_DWORD parameter CrashDumpEnabled with a value of 0×0, if a memory dump is not created; 0×1 – Complete memory dump; 0×2 – Kernel memory dump; 0x3 – Small memory dump (64KB);

– REG_EXPAND_SZ DumpFile parameter with the default value %SystemRoot%\MEMORY.DMP (dump file storage location);

– REG_DWORD parameter LogEvent with a default value of 0×1 (option Log event to the system log of the Boot and Recovery window);

– REG_EXPAND_SZ MinidumpDir parameter with the default value %SystemRoot%\Minidump (Small dump folder option of the Boot and Recovery window);

– REG_DWORD parameter Overwrite with a default value of 0×1 (option Overwrite existing dump file of the Boot and Restore window);

– REG_DWORD parameter SendAlert with a default value of 0x1 (option Send administrative alert of the Boot and Recovery window).

How the system creates a crash dump file

During boot, the operating system checks the crash dump settings in the registry key. If at least one parameter is specified, the system generates a map of disk blocks occupied by the paging file on the boot volume and stores it in memory. The system also determines which disk device driver controls the boot volume, calculates checksums for the driver's memory image, and for data structures that must be integer for the driver to perform I/O operations.

After a failure, the system kernel checks the integrity of the page file map, disk driver, and disk driver control structures. If the integrity of these structures is not violated, then the system kernel calls special I/O functions of the disk driver designed to save the memory image after a system failure. These I/O functions are self-contained and do not rely on kernel services because the programs responsible for writing the crash dump cannot make any assumptions about which parts of the system kernel or device drivers were damaged when a crash occurred. The system kernel writes data from memory to the paging file sector map (it does not have to use file system drivers).

First, the system kernel checks the status of each component involved in the dump process. This is done so that when writing directly to disk sectors, it does not damage data located outside the page file. The size of the page file should be 1 MB larger than the size of physical memory, because when information is written to the dump, a header is created that contains the crash dump signature and the values ​​of several critical system kernel variables. The header is less than 1MB, but the operating system can increase (or decrease) the size of the page file by at least 1MB.

After the system boots, Session Manager (Windows NT Session Manager; disk address - \WINDOWS\system32\smss.exe) initializes the system page files, using its own NtCreatePagingFile function to create each file. NtCreatePagingFile determines whether the page file being initialized exists and, if so, whether it has a dump header. If there is a header, then NtCreatePagingFile sends a special code to the Session Manager. Session Manager then starts the Winlogon process (Windows NT Logon Program; disk address is \WINDOWS\system32\winlogon.exe), which is notified of the existence of a crash dump. Winlogon runs the SaveDump program (Windows NT Memory Copy Program; disk address - \WINDOWS\system32\savedump.exe), which analyzes the dump header and determines further actions in an emergency situation.

If the header indicates the existence of a dump, then SaveDump copies the data from the page file to the crash dump file, the name of which is specified by the REG_EXPAND_SZ parameter of the DumpFile section of the Registry. While SaveDump rewrites the dump file, the operating system does not use the part of the page file that contains the crash dump. During this time, the amount of virtual memory available to the system and applications is reduced by the dump size (and messages may appear on the screen indicating that virtual memory is low). SaveDump then informs the memory manager that the dump has completed saving, and it releases the part of the page file in which the dump is stored for general use.

After saving the dump file, the SaveDump program records the creation of a crash dump in the System event log, for example: “The computer was rebooted after a critical error: 0x100000d1 (0xc84d90a6, 0x00000010, 0x00000000, 0xc84d90a6). Memory copy saved: C:\WINDOWS\Minidump\Mini060309-01.dmp".

If the Send administrative alert option is enabled, SaveDump sends an alert to the administrator.

Types of dumps

  • Full memory dump writes the entire contents of system memory when a fatal error occurs. For this option, you must have a paging file on the boot volume, the size of which is equal to the amount of all physical RAM plus 1MB. By default, a complete memory dump is written to the %SystemRoot%\Memory.dmp file. When a new error occurs and a new full memory dump (or kernel memory dump) file is created, the previous file is replaced (overwritten). The Full memory dump option is not available on PCs that have a 32-bit operating system and 2 gigabytes or more of RAM.

When a new error occurs and a new full memory dump file is created, the previous file is replaced.

  • Kernel memory dump writes only kernel memory, making the process of writing data to the log when the system suddenly stops proceeds faster. Depending on the amount of physical memory of the PC, in this case the paging file requires from 50 to 800MB or one third of the physical memory of the computer on the boot volume. By default, the kernel memory dump is written to the %SystemRoot%\Memory.dmp file.

This dump does not include unallocated memory or memory allocated to user-mode programs. It includes only memory allocated to the kernel and hardware-dependent layer (HAL) in Windows 2000 and later versions of the system, as well as memory allocated to kernel-mode drivers and other kernel-mode programs. In most cases, such a dump is the most preferable option. It takes up much less space than a full memory dump, while excluding only those memory sectors that are most likely not related to the error.
When a new error occurs and a new kernel memory dump file is created, the previous file is replaced.

  • Small memory dump records the smallest amount of useful information necessary to determine the cause of the problem. To create a small memory dump, the page file size must be at least 2MB on the boot volume.

Small memory dump files contain the following information:

  • fatal error message, its parameters and other data;
  • list of loaded drivers;
  • the processor context (PRCB) on which the failure occurred;
  • process information and kernel context (EPROCESS) for the process that caused the error;
  • process information and kernel context (ETHREAD) for the thread that caused the error;
  • The kernel-mode call stack for the thread that caused the error.

The small memory dump file is used when hard disk space is limited. However, due to the limited information it contains, analysis of this file may not always detect errors that were not directly caused by the thread that was running when the error occurred.

When the next error occurs and a second small memory dump file is created, the previous file is saved. Each additional file is given a unique name. The date is encoded in the file name. For example, Mini051509-01.dmp is the first memory dump file created on May 15, 2009. A list of all small memory dump files is stored in the folder %SystemRoot%\Minidump.

The Windows XP operating system is undoubtedly much more reliable than previous versions, thanks to the efforts of both Microsoft developers, hardware driver developers, and application software developers. However, emergency situations - all kinds of failures and system crashes - are inevitable, and whether the PC user has the knowledge and skills to eliminate them depends on whether he will have to spend a few minutes troubleshooting (for example, updating/debugging a driver or reinstalling an application). program causing a system crash) - or several hours to reinstall/configure the operating system and application software (which does not guarantee the absence of failures and crashes in the future!).

Many system administrators still neglect to analyze Windows crash dumps, believing that working with them is too difficult. It’s difficult, but it’s possible: even if, for example, the analysis of one dump out of ten turns out to be successful, the efforts spent on mastering the simplest techniques for analyzing crash dumps will not be in vain!..

I will give examples from my “sysadmin” practice.

On the local network, for no apparent reason (“the hardware is in order, the absence of viruses is guaranteed, the users have “normal hands”), several workstations with Windows XP SP1/SP2 “on board” went down. It was not possible to boot the computers in normal mode - it got to "Greetings" - and it took forever to reboot. At the same time, the PCs booted into Safe Mode.

Studying the memory dumps made it possible to identify the cause of the malfunction: the culprit turned out to be Kaspersky Anti-Virus, more precisely, fresh anti-virus databases (more precisely, two database modules - base372c.avc, base032c.avc).

...There was another such case. On a local PC running Windows XP SP3, a reboot occurred when trying to open video files in .avi and .mpeg formats. Studying the memory dump allowed us to identify the cause of the problem - the nv4_disp.dll file of the NVIDIA GeForce 6600 video card driver. After updating the driver, the problem was eliminated. In general, the nv4_disp.dll driver is one of the most unstable drivers, which often led to BSOD.

In both of these cases, studying the crash memory dump made it possible to reduce the time for diagnosing and eliminating the malfunction to a minimum (several minutes!).

Memory dump analysis

There are many programs for analyzing crash memory dumps, for example, DumpChk, Kanalyze, WinDbg.

Let's look at analyzing crash memory dumps using the WinDbg program (part of Debugging Tools for Windows).

Installing Debugging Tools

  • visit Microsoft Corporation's Web site http://www.microsoft.com/whdc/devtools/debugging/default.mspx;
  • download Debugging Tools for Windows, for example, for a 32-bit version of Windows this can be done on the Download the Debugging Tools for Windows page;
  • after downloading, run the installation file;
  • in the Debugging Tools for Windows Setup Wizard window, click Next;
  • in the window with the license agreement, select the I agree –> Next switch;
  • in the next window, select the installation type (by default, debugging tools are installed in the \Program Files\Debugging Tools for Windows folder) –> Next –> Install –> Finish;
  • To interpret memory dump files, you must also download the Symbol Packages for your version of Windows - go to the Download Windows Symbol Packages page;
  • select your version of Windows, download and run the Symbol Packages installation file;
  • in the window with the license agreement, click Yes;
  • in the next window, select the installation folder (the default is \WINDOWS\Symbols) –> OK –> Yes;
  • In the Microsoft Windows Symbols window with the message “Installation is complete,” click OK.

Using WinDbg to Analyze Crash Dumps

  • run WinDbg (installed in the \Program Files\Debugging Tools for Windows folder by default);
  • select menu File –> Symbol File Path…;
  • in the Symbol Search Path window, click the Browse… button;
  • in the Browse Folder window, specify the location of the Symbols folder (by default – \WINDOWS\Symbols) –> OK –> OK;
  • select menu File –> Open Crash Dump… (or press Ctrl + D);
  • in the Open Crash Dump window, specify the location of the Crash Dump File (*.dmp) –> Open;
  • in the Workspace window with the question “Save information for workspace?”, check the Don’t ask again –> No box;
  • The Command Dump window will open in the WinDbg window<путь_и_имя_файла_дампа>with dump analysis;
  • review the memory dump analysis;
  • in the “Bugcheck Analysis” section the possible cause of the crash will be indicated, for example, “Probably caused by: smwdm.sys (smwdm+454d5)”;
  • to view detailed information, click the “!analyze -v” link in the “Use !analyze -v to get detailed debugging information” line;
  • close WinDbg;
  • Use the information obtained to eliminate the cause of the problem.

For example, in the following screenshot the cause of the malfunction is the nv4_disp.dll file of the video card driver.