Reading small windows xp memory dumps. Using a memory dump to diagnose crashes
At the next step of selecting a component to install ( Select the features you want to install) we mark only what we need - Debugging tools for Windows and press Install
A set of utilities will be downloaded and installed from the Internet to the folder specified on the first screen.
After installation is complete, find it in the Start menu or on the start screen in the shortcut group Windows Kits utility WinDbg and run it with administrator rights
If for some reason the shortcut could not be found, you can run the executable file from the installation directory - C:\Program Files (x86)\Windows Kits\8.1\Debuggers\x64\windbg.exe
In the main menu of the program WinDbg select items File > Symbol File Path. In the window that opens, insert a line defining the local symbol cache directory and its online source:
SRV*C:\Windows\symbol_cache*http://msdl.microsoft.com/download/symbolsWe save the settings by selecting items in the main menu File > Save Workspace
Open the memory dump file by selecting from the menu File > Open Crash Dump...
Select a file MEMORY.DMP(located in the C:\Windows directory by default) and click Open
Information will appear about which executable module caused the system to stop working. By clicking on a hyperlink !analyze-v You can obtain more detailed information about the state of the system at the time the stop error occurred.
The same information can be obtained using the command line using approximately the following sequence of commands:
cd /d " C:\Program Files (x86)\Windows Kits\8.1\Debuggers\x64\" kd -z "D:\DOWNLOADS\VM05\MEMORY.DMP " .logopen C:\Debuglog.txt .sympath srv*C:\Windows\symbol_cache*http://msdl.microsoft.com/download/symbolsIn this example, all information about dump parsing will be downloaded in readable form to the file C:\Debuglog.txt
Information sources:
Errors very often occur in Windows OS, even in the case of a “clean” system. If ordinary program errors can be solved (a message about a missing component appears), then critical errors will be much more difficult to fix.
What is a memory dump in Windows
To solve problems with the system, a crash memory dump is usually used - this is a photo part or all of the RAM and placing it on a non-volatile medium (hard drive). In other words, the contents of RAM are fully or partially copied to the media, and the user can analyze the memory dump.
There are several types of memory dumps:
Small dump(Small Memory Dump) – saves a minimum amount of RAM, which contains information on critical errors (BSoD) and components that were loaded during system operation, for example, drivers, programs. MiniDump is stored in the path C:\Windows\Minidump.
Full dump(Complete Memory Dump) – the full amount of RAM is saved. This means that the file size will be equal to the amount of RAM. If there is little disk space, it will be problematic to save, for example, 32 GB. There are also problems with creating a memory dump file larger than 4 GB. This type is used very rarely. Stored at C:\Windows\MEMORY.DMP.
Dump kernel memory– only information related to the system core is saved.
When the user gets to analyzing the error, he only needs to use minidamp (small dump). But before this, it must be turned on, otherwise the problem will not be recognized. Also, to more effectively identify a crash, using a full memory snapshot is preferable.
Information in the registry
If you look in the Windows registry, you can find some useful snapshot settings. Click the Win+R key combination and enter the command regedit and open the following branches:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl
In this branch the user will find the following parameters:
- AutoReboot– enable or disable reboot after creating a Blue Screen of Death (BSoD).
- DumpFile– name of dump types and location.
- CrashDumpEnabled– the number of the file being created, for example, the number 0 – the dump is not created; 1 – creating a full dump; 2 – creating a core dump; 3 – creating a small dump.
- DumpFilters– the option allows you to add new functions before creating a snapshot. For example, file encryption.
- MinidumpDir– the name of the small dump and its location.
- LogEvent– activation of recording information in the system log.
- MinidumpsCount– set the number of small dumps to be created. (Exceeding this number will destroy old files and replace them).
- Overwrite– function for a full or system dump. When creating a new photo, the previous one will always be replaced with a new one.
- DedicatedDumpFile– creating an alternative image file and specifying its path.
- IgnorePagefileSize– used for temporary snapshot location, without using a swap file.
How it works
If a failure occurs, the system completely stops its operation and, if dumping is active, it will be written to a file placed on disk. information about the problem that has arisen. If something happened to the physical components, then an emergency code will work, and the hardware that failed will make some changes, which will certainly be reflected in the snapshot.
Usually the file is saved in a hard disk block allocated for the paging file; after a BSoD appears, the file is overwritten in the type that the user himself configured (Small, Full or Core Dump). Although, in modern operating systems, the participation of the paging file is not necessary.
How to enable dumps
IN Windows 7:
IN Windows 8 and 10:
Here the process is a little similar, you can get into the system information in the same way as in Windows 7. In “Ten”, be sure to open “ This computer", click on the free space with the right mouse button and select " Properties" Another way to get there is through the Control Panel.
Second option for Windows 10:
It should be noted that in new versions of Windows 10 new items have appeared that were not in the “seven”:
- Small dump memory 256 KB - minimum failure data.
- Active dump- appeared in the tenth version of the system and saves only the active memory of the computer, the system kernel and the user. Recommended for use on servers.
How to delete a dump
Just go to the directory where the memory snapshots are stored and simply delete them. But there is another way to remove it - using the Disk Cleanup utility:
If no items were found, the dumps may not have been enabled.
Even if you once enabled them, some system optimization utilities you use can easily disable some functionality. Often a lot of things are disabled when using SSD drives, since repeated read and write procedures greatly harm the health of the drive.
Memory dump analysis using WinDbg
Download this program from the official Microsoft website in step 2, where it is described “ InstallationWDK" - https://docs.microsoft.com/en-us/windows-hardware/drivers/download-the-wdk. 
To work with the program you will also need a special package of debugging symbols. It is called Debugging Symbols, previously it could be downloaded from the Microsoft website, but now they have abandoned this idea and you will have to use the File program function - “ Symbol File Path", where you should enter the following line and click OK:
set _NT_SYMBOL_PATH=srv*DownstreamStore*https://msdl.microsoft.com/download/symbols
If it doesn't work, try this command:
SRV*%systemroot%\symbols*http://msdl.microsoft.com/download/symbols
Click “File” again and select the “Save Workspace” option.
The utility is configured. All that remains is to specify the path to the memory dump files. To do this, click File and click the option “ OpenCrashDump" The location of all dumps is indicated at the beginning of the article.
After selection, the analysis will end and the problematic component will be automatically highlighted. To obtain more information in the same window, you can enter the following command: !analyze –v 
Analysis with BlueScreenView
You can download the tool for free from this site - http://www.nirsoft.net/utils/blue_screen_view.html. Installation does not require any skills. Only used on Windows 7 and higher.
We launch and configure. Click “Options” – “ Extra options"(Advanced Options). Select the first item " Load MiniDumps from this folder"and indicate the directory - C:\WINDOWS\Minidump. Although you can simply click the “Default” button. Click OK.
The dump files should appear in the main window. It can be either one or several. To open it, just click on it with the mouse. 
The bottom of the window will display the components that were running at the time of the failure. The person responsible for the accident will be highlighted in red.
Now click “File” and select, for example, the item “ Find in Google error code + driver" If you find the driver you need, install and restart your computer. Perhaps the error will disappear.
If a critical error occurs while working with Windows, the user may wonder: how can I access a Windows crash dump? Such a dump, if the system configuration is correctly configured, will help start the system in the event of a crash or the so-called blue screen of death (BSOD).
If you encounter problems while setting up a memory dump or the operating system does not work correctly after this, you can.
Windows 10 memory dump
A memory dump is something that is located in the working memory of the entire operating system, the processor and its cores. Including all information about the state of processor registers and other service structures.
Why do you need a Windows 10 memory dump?
A Windows 10 memory dump is a kind of black box. In the event of a system failure, the information stored in it will help to study in detail the causes of the system failure. This failure usually completely stops the operating system. Therefore, a memory dump is the only and most reliable way to obtain information about any failure in the system. And receiving it is an actual snapshot of the information located in the system.
The more accurately the contents of the memory dump reflect what was happening in the system at the time of the failure, the easier it will be when analyzing the emergency situation and further actions to correct it.
It is extremely important to obtain an up-to-date copy at the exact moment immediately before the failure. And the only way to do this is to create a Windows 10 crash dump.
The reasons for errors in Windows 10 are very diverse:
– incompatibility of connected devices;
– new Windows 10 updates;
– incompatibility of installed drivers;
– incompatibility of installed applications;
- and other reasons.
How to set up a memory dump in Windows 10?
In order to set up a Windows 10 crash dump, you must follow these steps:
1. Right-click on Windows 10 start. In the context menu that appears, select “System”.
2. In the “System” window, in the upper left corner, select “Advanced system settings”.
3. In the “System Properties” window, in the “Boot and Recovery” item, click “Options”.
This is where you set up a Windows 10 crash dump.
When setting up a memory dump, you can not neglect the following recommendations:
– Check the box “replace existing dump file”. Considering the fact that data can weigh tens or even hundreds of gigabytes, this is very useful for small hard drives;
– Recording debugging information. This function will allow you to select the type of dump file;
– Perform an automatic reboot. Continuing work after an error has occurred;
– Recording an event in the system log. Information about the system failure will be added to the operating system logs.
A Windows 10 memory dump is a convenient and really working method of insuring system data.
Knowing the enemy “in person” will make it much easier to find and eliminate him. A Windows 10 memory dump will allow you to identify the cause of a system failure and adjust actions to eliminate the error, significantly reducing the radius of effort and work.
Or, as it is also called, BSOD, can significantly ruin the life of both the computer and the server, and it also turned out to be a virtual machine. Today I’ll tell you how to analyze the blue screen of dump memory in Windows, since correct diagnosis and getting the reason why your system is not working, 99 percent of its solution, especially a system engineer, is simply obliged to be able to do this, and in the shortest possible time, so How can a business lose a lot of money due to service downtime?
BSOD decryption
Let's first look at what this abbreviation means, BSOD from the English Blue Screen of Death or also STOP error mode.
Blue screen of death errors occur for various reasons, including driver problems, a faulty application, or a faulty RAM module. As soon as you have a blue screen in Windows, your system will automatically create a crash memory dump file, which we will analyze.
How to configure memory dump creation
By default, when there is a blue screen, Windows creates a crash dump file memory.dmp, now I will show how it is configured and where it is stored, I will show using Windows Server 2008 R2 as an example, since I recently had a task to study the issue of a blue screen in a virtual machine. In order to find out where dump memory windows is configured, open Start and right-click on the Computer icon and select properties.
How to analyze blue screen dump memory in Windows - Computer Properties
How to analyze blue screen dump memory in Windows system settings
Go to the Advanced tab - Boot and Recovery. Click the Settings button
How to analyze blue screen dump memory in Windows - Boot and recovery
Where is the memory.dmp file stored?
and we see that first of all there is a checkbox to perform an automatic reboot to record debugging information, Kernel memory dump is selected and below there is where the memory dump is saved %SystemRoot%\MEMORY.DMP
Let's go to the c:\windows\ folder and find the file MEMORY.DMP it contains blue screen of death codes
How to analyze blue screen dump memory in Windows-memory.dmp
How to set up mini dump
Blue screen of death errors are also recorded in the small memory dump; it is configured there, you just need to select it.
It is stored in the c:\windows\minidump folder. The advantage is that it takes up less space and is created as a separate file for each blue screen. You can always view the history of blue screen occurrences.
Now that we have figured out where to look for the memory dump file, we need to learn how to interpret it and understand the reason why the blue screen of death occurs. Microsoft Kernel Debugger will help us solve this problem. You can download Microsoft Kernel Debugger from the official website, the main thing is to select the desired OS version. If someone breaks it, you can download it from the Yandex disk using a direct link. It is also part of ADK.
Download Microsoft Kernel Debugger, as a result you will have a small file that will allow you to download everything you need from the Internet. Let's launch it.
We will not participate in the quality improvement program
Click Accept and agree to the license
How to install Microsoft Kernel Debugger - agree to the license
Microsoft Kernel Debugger installation will begin
How to Install Microsoft Kernel Debugger - MKD Installation
We see that Microsoft Kernel Debugger has been successfully installed
After which we see that the Debugging Tools for Windows folder has appeared in the startup for both 32 and 64 bit systems.
In addition to the Debugging Tools for Windows package itself, you will also need a set of debugging symbols - Debugging Symbols. The set of debugging symbols is specific to each OS on which the BSoD was recorded. Therefore, you will have to download a set of symbols for each OS whose operation you will have to analyze. A 32-bit Windows XP will require the Windows XP 32-bit character set; a 64-bit OS will require the Windows XP 64-bit character set. For other operating systems of the Windows family, character sets are selected according to the same principle. You can download debugging symbols from here. It is recommended to install them at %systemroot%\symbols although I like to install them in separate folders and avoid cluttering the Windows folder.
Blue Screen Analysis in Debugging Tools
After installing Debugging Symbols for the system that had the blue screen of death, launch Debugging Tools
How to install Microsoft Kernel Debugger - Run
Before analyzing the contents of the memory dump, you will need to do a little configuration of the debugger. Specifically, tell the program where to look for debugging symbols. To do this, select File > Symbol File Path… from the menu.
Click the Browse button...
and indicate the folder in which we installed the debugging symbols for the memory dump in question, you can specify several folders separated by commas and you can request information about the required debugging symbols directly via the Internet, from a public Microsoft server. This way you will have the latest version of the symbols. You can do this as follows - in the File > Symbol File Path… menu, enter:
SRV*%systemroot%\symbols*http://msdl.microsoft.com/download/symbols
How to analyze the blue screen of death
We copy the memory.dmp or minidump file from the computer where the blue screen popped up, and open it, select File > Open Crash Dump... from the menu and select the file required for consideration.
How to analyze the blue screen of death-01
For example, choose minidump
How to analyze the blue screen of death - open minidump
The analysis of the minidump will begin, we see a link to the error appear, click on it for more detailed information about the blue screen.
How to analyze the blue screen of death-03
And we see a faulty application that is destroying your system, you can also see what’s wrong in even more detail by clicking on the link.
How to analyze the blue screen of death-04
Get more detailed information about the cause of the blue screen.
How to analyze the blue screen of death-05
If you open memory.dmp, you will get a similar picture and see why you got a blue screen.
How to analyze the blue screen of death-06
This is how easy it is to diagnose and eliminate the blue screen of death.
By and large, you, as a user, should not be interested in a memory dump. This is just information about a system failure, which ideally should be sent to Microsoft developers to find and fix critical errors. If you do not plan to engage in such charity, then you can disable the dump.
Disabling memory dump will not affect system performance in any way. When you use your computer, the system does not access the dump, whether it is turned on or not. Recording occurs only when Windows is “brought” to BSOD (blue screen). It lasts a couple of seconds at most.
Types of dump
For general development, let's get acquainted with the types of dump. There are three of them: small dump, core dump and large. A small dump stores the most important information about the problem. Developers literally have to piece it together bit by bit. For a small dump you need to allocate 2 MB of virtual memory (swap file).
Core dump– the most common type of dump. This option is usually the default. It records all the memory that is allocated to the core - the state of working drivers and data on the hardware-dependent level. For it you need to allocate about 30% of the total amount of RAM. For example, if you have 2 GB DDR, then allocate about 700 MB for the swap file.
A full dump records the entire contents of RAM. Accordingly, for it to work, you will have to allocate the same volume to the paging file as RAM. We need a full dump for hibernation mode, when all data from RAM is loaded onto the hard drive.
In Windows 7, the dump parameters are hidden quite deeply. Enter in the search bar in the menu " Start" word " system", For example.
Select result " System" A window will open. There is a list of options at the top right, select the last one - “ Advanced System Settings».
