Windows: Debug a bluescreen

open minidump

After a BSOD you might want to find out the reason.
Eventlog is a good starting point, but you should look into the minidump as well.

Install

Open

The file you need to open is located in C:\Windows\Minidump

cd "C:\Program Files\Debugging Tools for Windows (x64)"
windbg.exe -z C:\Windows\Minidump\Mini??????-??.dmp -c "!analyze -v"

It will take a while and the debugger will download the required symbols from the MS homepage.
At the end you will see what was on the stack before the system crashed.
There is also a line called “Probably caused by”, which is a good point to start with.
The stack will show you what commands have been executed before the system crashed and there you can also often see what was happening.
Often the crash is caused by a driver and in that case you should check for a new version.

Message: Kernel symbols are WRONG. Please fix symbols to do analysis

In that case the symbol path is wrong. Here is how you can fix it:

view -> command \\

Type into the prompt on the bottom of the screen (the kd> is already there):

kd> .sympath SRV*C:\symbols*http://msdl.microsoft.com/download/symbols
kd> .reload

Please change C:\symbols if you want to place them somewhere else.

Tagged , ,