Windows Crash Dump Analysis - 1

Crash Dump - is a file that windows will create it when it gives you the Blue Screen of death (BSOD) error.

Configure the dump type:

To configure startup and recovery options to use the small memory dump file, follow these steps.

Note Because there are several versions of Microsoft Windows, the following steps may be different on your computer. If they are, see your product documentation to complete these steps.

1. Click Start, point to Settings, and then click Control Panel.
2. Double-click System.
3. Click the Advanced tab, and then click Settings under Startup and Recovery.
4. In the Write debugging information list, click Small memory dump (64k).
   
   To change the folder location for the small memory dump files, type a new path in the Dump File box (or in the Small dump directory box, depending on your version of Windows).

Examine the dump file:

There are several commands that you can use to gather information in the dump file, including the following commands:

• The !analyze -show command displays the Stop error code and its parameters. The Stop error code is also known as the bug check code.
• The !analyze -v command displays verbose output.
• The lm N T command lists the specified loaded modules. The output includes the status and the path of the module.

ref:

Crash dump Analysis - http://msdn.microsoft.com/en-us/library/ee416349(VS.85).aspx

Analyzing Windows Crash Dump or Minidump with WhoCrashed (by Raymond Chen) -http://www.raymond.cc/blog/archives/2009/01/17/analyzing-windows-crash-dump-or-minidump-with-whocrashed/

How to debug Crash Dumps - http://thehiddenguide.com/how-to-analysis-crash-dump/

How to read the small memory dump files that Windows creates for debugging – http://support.microsoft.com/kb/315263/en-us

Windows Crash Dump Analysis Video - http://technet.microsoft.com/en-us/ff606436.aspx

Crash Dump Analysis using WinDbg - http://www.networkworld.com/news/2005/041105-windows-crash.html

WhoCrashed reveals the drivers responsible for crashing your computer - http://www.resplendence.com/whocrashed

Online community for windows support - http://www.windowsbbs.com/general-discussions/33471-dump-data-collection-tool-instructions.html

WinDbg Tutorial - http://www.codeproject.com/KB/debug/windbg_part1.aspx

Writing WinDbg extensions - http://www.codeproject.com/KB/debug/cdbntsd4.aspx

Remote Kernel debugging with WinDbg - http://www.wd-3.com/archive/RemoteDbg.htm

windbg the easy way –

http://www.debuginfo.com/articles/easywindbg2.html (Part1)

http://www.debuginfo.com/articles/easywindbg.html (Part2)

Find leak in Managed Program - http://blogs.msdn.com/delay/archive/2009/03/11/where-s-your-leak-at-using-windbg-sos-and-gcroot-to-diagnose-a-net-memory-leak.aspx

SOS WinDbg extension to debug managed programs - http://msdn.microsoft.com/en-us/library/bb190764.aspx

(The SOS Debugging Extension (SOS.dll) helps you debug managed programs in the WinDbg.exe debugger and in Visual Studio by providing information about the internal common language runtime (CLR) environment)