WinDbg Analysis of Windows Blue Screen Dump Files
The most annoying thing about fixing computers isn't anything else; it's random Blue Screen of Death (BSOD) errors. Because you never know when a BSOD will occur. This randomness, combined with the lack of error reports, is the most headache-inducing aspect. However, in reality, every time Windows experiences a BSOD, it generates a Dump File in the system directory. This is the so-called analysis report. However, understanding this report requires some techniques.
Generally, reading Mini Dump files can be easily viewed using Nirsoft's BlueScreenView. However, this software is just a lightweight analysis tool. It only provides crash time, crash codes, files causing the crash, crash memory addresses, etc. Manual analysis is required, which for many beginners is like reading an alien script.
Well, is there a tool that helps analyze these alien script codes? Yes! That is WinDBG, a Debug tool developed by Windows itself - WinDbg.
I. What is WinDbg?
WinDbg is a powerful user-mode and kernel-mode debugging tool on the Windows platform. It can easily locate the root cause of issues through dmp files. It is used to analyze the causes of blue screens and program crashes (such as IE crashes). It is an indispensable and powerful tool in our daily work. Learning to use it will significantly improve our problem-solving efficiency and accuracy.
II. WinDbg Download Links
Blue Screen Dump Analysis Tool x86 Version Download: [Microsoft Official Installer]
Blue Screen Dump Analysis Tool x64 Version Download: [Microsoft Official Installer]
If you are using Windows 10, it is recommended to download the official SDK.
Download Link
There are many installation options; simply select 'Debugging Tools for Windows' as shown in the figure:
III. How to Use WinDbg
First, we need to set up the symbol path. The symbol path is WinDbg's key 'database', which stores various blue screen code analysis results. Without it, WinDbg is basically useless and cannot analyze further causes of problems.
1. Run the WinDbg software, then press [Ctrl+S] to pop up the symbol path settings window.
2. Paste the symbol path address: SRV*C:\Symbols*http://msdl.microsoft.com/download/symbols into the input box and click OK.
Note: The red text indicates the local storage path for symbols. It is recommended to use a fixed path to avoid repeated downloads of the symbol table.
After obtaining a dmp file, you can use the [Ctrl+D] shortcut to open it, or click the [File => Open Crash Dump...] button on the WinDbg interface to open a dmp file. When opening a dmp file for the first time, you might receive the following prompt. When this prompt appears, check 'Don't ask again in this WinDbg session', then click No.
When you want to open a second dmp file, it may not be possible to directly analyze the next dmp file because the previous analysis record has not been cleared. In this case, you can use the shortcut key [Shift+F5] to close the previous dmp analysis record.
At this point, you have learned the basic usage of WinDbg!
V. Learn to Analyze Some DMP Files Through Simple Steps
1. Open any Dump file. You will see a blue 'Analyze' link below. This link is the tool link for analyzing blue screens.
Then you can see this information:
!analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
WHEA_UNCORRECTABLE_ERROR (124)
A fatal hardware error has occurred. Parameter 1 identifies the type of error
source that reported the error. Parameter 2 holds the address of the
WHEA_ERROR_RECORD structure that describes the error conditon.
Arguments:
Arg1: 0000000000000000, Machine Check Exception
Arg2: ffff8305fd0dd028, Address of the WHEA_ERROR_RECORD structure.
Arg3: 00000000b6000004, High order 32-bits of the MCi_STATUS value.
Arg4: 000000000001010a, Low order 32-bits of the MCi_STATUS value.
Debugging Details:
------------------
DUMP_CLASS: 1
DUMP_QUALIFIER: 400
BUILD_VERSION_STRING: 10.0.15063.674 (WinBuild.160101.0800)
SYSTEM_MANUFACTURER: Acer
SYSTEM_PRODUCT_NAME: Aspire ES1-711
SYSTEM_SKU: Aspire ES1-711_0843_1_08
SYSTEM_VERSION: V1.08
BIOS_VENDOR: Insyde Corp.
BIOS_VERSION: V1.08
BIOS_DATE: 10/28/2015
BASEBOARD_MANUFACTURER: Acer
BASEBOARD_PRODUCT: EA70_BM
BASEBOARD_VERSION: Type2 - A01 Board Version
DUMP_TYPE: 2
BUGCHECK_P1: 0
BUGCHECK_P2: ffff8305fd0dd028
BUGCHECK_P3: b6000004
BUGCHECK_P4: 1010a
BUGCHECK_STR: 0x124_GenuineIntel
CPU_COUNT: 4
CPU_MHZ: 877
CPU_VENDOR: GenuineIntel
CPU_FAMILY: 6
CPU_MODEL: 37
CPU_STEPPING: 8
CPU_MICROCODE: 0,0,0,0 (F,M,S,R) SIG: 829'00000000 (cache) 0'00000000 (init)
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT
CURRENT_IRQL: 0
ANALYSIS_SESSION_HOST: SERVICE01
ANALYSIS_SESSION_TIME: 10-17-2017 15:18:05.0073
ANALYSIS_VERSION: 10.0.16299.15 amd64fre
STACK_TEXT:
fffff801`aa64ca38 fffff801`a824e5cf : 00000000`00000124 00000000`00000000 ffff8305`fd0dd028 00000000`b6000004 : nt!KeBugCheckEx
fffff801`aa64ca40 fffff801`a84ed2fd : ffff8305`fd0dd028 ffff8305`fc5ac790 ffff8305`fc5ac790 ffff8305`fc5ac790 : hal!HalBugCheckSystem+0xcf
fffff801`aa64ca80 fffff801`a824eaf8 : 00000000`00000728 00000000`00000000 00000000`00000000 00000000`00000000 : nt!WheaReportHwError+0x25d
fffff801`aa64cae0 fffff801`a824ee58 : 00000000`00000010 00000000`00000000 fffff801`aa64cc88 00000000`00000000 : hal!HalpMcaReportError+0x50
fffff801`aa64cc30 fffff801`a824ed46 : ffff8305`fbea5650 00000000`00000001 00000000`00000000 00000000`00000000 : hal!HalpMceHandlerCore+0xe0
fffff801`aa64cc80 fffff801`a824ef8a : 00000000`00000004 00000000`00000001 00000000`00000000 00000000`00000000 : hal!HalpMceHandler+0xda
fffff801`aa64ccc0 fffff801`a824f120 : ffff8305`fbea5650 fffff801`aa64cef0 00000000`00000000 00000000`00000000 : hal!HalpMceHandlerWithRendezvous+0xce
fffff801`aa64ccf0 fffff801`a84076bb : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : hal!HalHandleMcheck+0x40
fffff801`aa64cd20 fffff801`a840742c : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KxMcheckAbort+0x7b
fffff801`aa64ce60 fffff801`a83881d3 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiMcheckAbort+0x1ac
ffffa001`1208c898 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!ST_STORE::ST_HASH_ENTRY_COMPARATOR::Compare+0x33
THREAD_SHA1_HASH_MOD_FUNC: 1229599e20a8e52284b639d82c0e4b08e5ebac03
THREAD_SHA1_HASH_MOD_FUNC_OFFSET: 947846f6d18d00900d62ba102bf881c74cd600ba
THREAD_SHA1_HASH_MOD: bba6629b38ee48af58586b1285e003efb528212b
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: GenuineIntel
IMAGE_NAME: GenuineIntel
DEBUG_FLR_IMAGE_TIMESTAMP: 0
STACK_COMMAND: .thread ; .cxr ; kb
FAILURE_BUCKET_ID: 0x124_GenuineIntel_PROCESSOR_CACHE
BUCKET_ID: 0x124_GenuineIntel_PROCESSOR_CACHE
PRIMARY_PROBLEM_CLASS: 0x124_GenuineIntel_PROCESSOR_CACHE
TARGET_TIME: 2017-10-17T16:11:46.000Z
OSBUILD: 15063
OSSERVICEPACK: 674
SERVICEPACK_NUMBER: 0
OS_REVISION: 0
SUITE_MASK: 784
PRODUCT_TYPE: 1
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS Personal
OS_LOCALE:
USER_LCID: 0
OSBUILD_TIMESTAMP: 2017-09-29 03:20:26
BUILDDATESTAMP_STR: 160101.0800
BUILDLAB_STR: WinBuild
BUILDOSVER_STR: 10.0.15063.674
ANALYSIS_SESSION_ELAPSED_TIME: 14b0
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:0x124_genuineintel_processor_cache
FAILURE_ID_HASH: {4c8f3f5e-1af5-ed8b-df14-d42663b1dfa7}
Followup: MachineOwner
The top part contains basic computer information, which is generally not very useful. Next is the offset address of the blue screen error. If you do not understand assembly language, this part is also not very useful to you. The most important part is here:
From here, we can see that the faulty module (MODULE_NAME) is GenuineIntel, and the error message is 0x124_GenuineIntel_PROCESSOR_CACHE. This means there was an error in the Intel CPU cache. Basically, it can be determined to be a hardware issue. Try replacing the CPU to fix it.
Appendix: Setting Up Windows Dump Files
By default, Windows usually saves all information in the MEMORY.DMP file located in the Windows folder. However, often this file does not exist, or you only need a Mini Dump file. You can configure it as follows:
2. System Protection
5. After the next blue screen, the Dump file will be saved in the Windows\Minidump folder.
PS:
Other common blue screen errors include Driver and graphics card issues. Accumulating experience will allow for simple diagnosis. Alternatively, you can submit the analyzed files to Microsoft or post on forums. A quick search using a search engine will usually yield answers.
ref:
http://support.icafe8.com/technologynews/focus/932.html
http://kuang1984tw.pixnet.net/blog/post/164754820-%E3%80%90%E8%97%8D%E5%B1%8F%E5%88%86%E6%9E%90%E3%80%91debugging-tools-for-windows-10---%E8%AE%93%E4%BD%A0%E5%BE%9E