Re: How to debug a memory dump ?

Tech-Archive recommends: Repair Windows Errors & Optimize Windows Performance

As I said in my first post, I knew there was all these articles. But to know
which one to use, I need to identify the driver that caused the exception.
For that, I followed the article 314084 but I don't have the field
ExceptionAddress , as I shown in my second post. Does anyone know how to
debug a memory dump in Windows XP SP2 ?

"Wesley Vogel" wrote:

> Oops. Just found this in my drafs folder. I thought I sent it.
>
> Was there an error in the Event Viewer in Application or System around the
> time that you see the Save Dump? I.e. Date: 7/27/2005 Time: 12:14:56 PM
>
> DRIVER_IRQL_NOT_LESS_OR_EQUAL brings up a lot of hits.
> http://support.microsoft.com/search/default.aspx?catalog=LCID%3D1033&query=DRIVER_IRQL_NOT_LESS_OR_EQUAL+&x=15&y=11
>
> --
> Hope this helps. Let us know.
>
> Wes
> MS-MVP Windows Shell/User
>
> In news:944C4C43-3FDC-41CF-99FB-EA679E6BA201@xxxxxxxxxxxxx,
> Jacques <Jacques@xxxxxxxxxxxxxxxxxxxxxxxxx> hunted and pecked:
> > The event is shown below but it's not helpful :
> >
> > Event Type: Information
> > Event Source: Save Dump
> > Event Category: None
> > Event ID: 1001
> > Date: 7/27/2005
> > Time: 12:14:56 PM
> > User: N/A
> > Computer: COMPAQ-VDHFEUVA
> > Description:
> > The computer has rebooted from a bugcheck. The bugcheck was: 0x100000d1
> > (0xf6775328, 0x00000002, 0x00000000, 0xf6775328). A dump was saved in:
> > C:\WINDOWS\Minidump\Mini072705-01.dmp.
> >
> > For more information, see Help and Support Center at
> > http://go.microsoft.com/fwlink/events.asp.
> >
> >
> >
> > "Wesley Vogel" wrote:
> >
> >>
> http://support.microsoft.com/search/default.aspx?catalog=LCID%3D1033&query=DRIVER_IRQL_NOT_LESS_OR_EQUAL&x=13&y=13
> >>
> >> Look in the Event Viewer.
> >>
> >> Event ID & the Event Source are very important.
> >>
> >> To open the Event Viewer...
> >> Start | Run | Type: eventvwr | Clcik OK
> >>
> >> For any Events that seem related to the problem...
> >>
> >> Double click the event in Event Viewer | Click: the button below the
> >> second arrow (looks like two pages) [[Copies the details of the event to
> >> the Clipboard.]] | Paste into Notepad | Click:
> >> For more information, see Help and Support Center at
> >> http://go.microsoft.com/fwlink/events.asp.
> >>
> >> Read all info | Copy and paste to Notepad | Click the [+] Related
> >> Knowledge Base articles | Follow any links that might be useful
> >>
> >> HOW TO: View and Manage Event Logs in Event Viewer in Windows XP
> >> http://support.microsoft.com/default.aspx?scid=kb;en-us;308427
> >>
> >> Event Viewer overview
> >>
> http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/event_overview_01.mspx
> >>
> >> This can also be very useful.
> >> You need to have the Event ID & the Event Source.
> >>
> >> To view Windows XP Events and Errors, type the Source (for example,
> >> Print) and/or the Event code (for example, 20) into the ID field, then
> >> click the Go button. Source and Event codes may be found in the Event
> >> Viewer logs.
> >>
> >> Windows XP Home/Professional Events and Errors
> >>
> http://www.microsoft.com/technet/support/ee/search.aspx?DisplayName=Windows%20XP%20Professional&ProdName=Windows%20Operating%20System&MajorMinor=5.1&LCID=1033
> >>
> >> --
> >> Hope this helps. Let us know.
> >>
> >> Wes
> >> MS-MVP Windows Shell/User
> >>
> >> In news:5C9674D5-351B-4B83-BE62-D62DAB41D6B0@xxxxxxxxxxxxx,
> >> Jacques <Jacques@xxxxxxxxxxxxxxxxxxxxxxxxx> hunted and pecked:
> >>> I had a blue screen with the error : DRIVER_IRQL_NOT_LESS_OR_EQUAL .
> >>> On the Microsoft knowledge base, there are different articles and I
> >>> don't which one is the right one.
> >>> So I saw the article 314084 (
> >>> http://support.microsoft.com/default.aspx?scid=kb;en-us;314084&sd=ee )
> >>> which explains how to gather information after a memory dump in Windows
> >>> XP. It says that using dumpchk.exe , one can get a value for
> >>> ExceptionAddress. The problem is that when I use dumpchk.exe, I don't
> >>> see any field called ExceptionAddress.
> >>> Probably dumpchk.exe has been updated for Service Pack 2 and the
> >>> Microsoft article doesn't apply to SP 2.
> >>> I would liek to identify the driver that caused the exception.
> >>> Can you help ?
>
>
.

Relevant Pages

  • Re: How to debug a memory dump ?
    ... Look in the Event Viewer. ... You need to have the Event ID & the Event Source. ... To view Windows XP Events and Errors, type the Source ... > On the Microsoft knowledge base, there are different articles and I don't ...
    (microsoft.public.windowsxp.general)
  • Re: How to debug a memory dump ?
    ... Was there an error in the Event Viewer in Application or System around the ... MS-MVP Windows Shell/User ... >> Event ID & the Event Source are very important. ... >>> On the Microsoft knowledge base, there are different articles and I ...
    (microsoft.public.windowsxp.general)
  • RE: Event ID Help Please.
    ... NOT run CRM, I do NOT run Server 2003, and I have already read those ... I cleared my event viewer to attempt to check as they ... None of the KB articles regarding side-by-side errors seem to apply as they ... Reference error message: The operation completed successfully. ...
    (microsoft.public.windowsxp.help_and_support)
  • Re: Segmentation fault
    ... The first post to mention ... either get a better newsreader or learn to use the one you ... You can also reconstruct the thread with "A T" as well as mark articles ... which runs under emacs; ...
    (comp.lang.c)
  • Re: notification if new posts in marked threads
    ... This should be my first post sent with tin. ... By default tin only shows unread articles. ... other commands than on the Thread Level, ...
    (news.software.readers)