loading
Blue screens of death can be caused by a multitude of factors. There are many tools on the internet that can analyze these; however, Microsoft has its own tool. When a computer is exhibiting problems, most users are reluctant to download a 3rd party tool that "might make things worse." This is where the Windows Debugging Tools come into play.

This How to Will Instruct a User on How to Install the Tool and How to Analyze a Crash Dump to Determine the Cause.

Step 1: Download the Debugging Tools for Windows

The tools are included as part of the Windows Software Development Kit (SDK) for Windows. We only want the tools.

Step 2: Run the Setup for the SDK

The installer is a downloader for the complete SDK. We don't want all the extras, we just want the tools.
  1. Click Next through the installer until you reach the screen that downloads the packages, labeled: "Select the features you want to install."
  2. Deselect all the checkboxes next to all the packages except Debugging tools for Windows
  3. Click Install.

Step 3: Wait for the Installer

Wait for the installer to download the packages and install them. Once the installation is complete, click on Close.

Step 4: Run WinDbg

  1. Run Windbg as administrator. The screenshot is from Windows 8.1, but this step is the same for all Operating systems Vista and higher, run as Administrator.
    1. On Windows 8.1, this is achieved by searching for the program, then Right Clicking it in the list to the right.
    2. It is important that Windbg be ran as Administrator.
      1. On Windows 8 and higher machines, there are permission issues reading crash dumps when the user isn't elevated.

Step 5: Set the Symbol Path

Windbg requires a symbol file path.
  1. Click on File
  2. Click on Symbol File Path ...

Step 6: Input the Symbols File Path

  1. Paste the following text into the Symbol Search Path Dialog
    1. SRV*C:\Windows\symbol_cache*http://msdl.microsoft.com/download/symbols
  2. Click OK

Step 7: Save the Workspace

  1. Click on File
  2. Click on Save Workspace

Step 8: Open the Crash Dump

  1. Click on File
  2. Click on Open Crash Dump...
  3. Navigate to: C:\Windows\
  4. Select the file named MEMORY.DMP
  5. Click Open

Step 9: Analyze!

After opening the crash dump, a window will spawn. The window will rapidly fill with text.
  1. At the bottom of the wall of text, you will notice a line with the text:
    1. Probably caused by :
      1. If you can imagine, thats what caused the BSOD.
      2. Google the thing that caused your bsod
        1. For example: In this instance i would google
          1. BSOD Win8.1 NETIO.SYS
OPTIONAL
At the bottom of the block of text, there will be a blue link with the words !analyze -v
  1. Click on the blue link named !analyze -v
  2. This will give a further detailed analysis to post on a forum, or send to someone else.
  3. It will also tell you what kind of fault it was, in this instance, my bsod was a
    1. DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT

Step 10: Optional: Save the Output

If you wish to save the output to a Text File:
  1. Click on Edit
  2. Click on Write Window Text to File...
  3. Choose a location that is easy to remember, such as Documents.
  4. Share the text file with people that can help!
  5. Done!
nice job on this<br> will this work on windows xp pro sp3
Hi thebear1, I have modified the first step to include information (a different download link) about Vista and Windows XP.<br> <br> All the sequential steps will be the same. The only difference is the GUI will be slightly different, but the package to download will be named the same. (Also you won't need to run as Administrator on Windows XP unless you're a limited user)&nbsp;<br> <br> Thanks for pointing that out! :)
<p>Hi Azerial,</p><p>I ran through all of the steps as described. However, when I try to open the Memory.dmp file I get the following message:</p><p>&quot;Loading Dump File [C:\Windows\MEMORY.DMP]</p><p>Kernel Bitmap Dump File: Only kernel address space is available</p><p>Invalid directory table base value 0x0&quot;</p><p>I also get a popup window titled &quot;WinDgb:6.3.9600.17298 AMD64&quot;</p><p>The windows says: </p><p>&quot;Could not find the C:\\Windows\MEMORY.DMP Dump File, Win32 error 0n1392</p><p>The file or directory is corrupted or unreadable.&quot;</p><p>I'm using Windows 8.1 on a late 2014 Dell XPS 13. I recently reinstalled Windows per Dell customer support's advice. Subsequently, I got a BSOD with a &quot;Bad_Pool_Caller&quot; code.</p><p>I really don't have much of an idea where to go from here. I'd appreciate any advice you could offer. Thanks in advance!</p>
<p>thanks!!! </p>
<p>Thanks.</p>
I have a Windows 8 this blue screen appears and restart it self and then says Window repearing it self but failed to do that and then blue screen appears and restart again and I don't want to lose my data photos and videos so what should I do need help plz
<p>Dear Azerial,<br><br>Thank you for your valuable information, It's very clear. I've successfully install the debugging tools. <br><br>When I following your guideline just faced following information. What does it mean ?<br>How to understand that messages ? It has any other commands ?<br><br>********************************#######################*********************************<br>Microsoft (R) Windows Debugger Version 6.3.9600.17336 AMD64<br>Copyright (c) Microsoft Corporation. All rights reserved.<br><br><br>Loading Dump File [F:\MEMORY.DMP]<br>Kernel Summary Dump File: Only kernel address space is available<br><br><br>************* Symbol Path validation summary **************<br>Response Time (ms) Location<br>Deferred SRV*C:\Windows\symbol_cache*http://msdl.microsoft.com/download/symbols<br>Symbol search path is: SRV*C:\Windows\symbol_cache*http://msdl.microsoft.com/download/symbols<br>Executable search path is: <br>Windows 7 Kernel Version 7601 (Service Pack 1) MP (40 procs) Free x64<br>Product: Server, suite: TerminalServer DataCenter SingleUserTS<br>Built by: 7601.18113.amd64fre.win7sp1_gdr.130318-1533<br>Machine Name:<br>Kernel base = 0xfffff800`01810000 PsLoadedModuleList = 0xfffff800`01a53670<br>Debug session time: Tue Jun 30 15:16:55.617 2015 (UTC + 9:00)<br>System Uptime: 0 days 6:48:24.546<br>Loading Kernel Symbols<br>...............................................................<br>................................................................<br>...................<br>Loading User Symbols<br>PEB is paged out (Peb.Ldr = 000007ff`fffd5018). Type &quot;.hh dbgerr001&quot; for details<br>Loading unloaded module list<br>.....<br>*******************************************************************************<br>* *<br>* Bugcheck Analysis *<br>* *<br>*******************************************************************************<br><br>Use !analyze -v to get detailed debugging information.<br><br>BugCheck 1A, {41201, fffff68000125000, 7f87312b, fffffa8067073a40}<br><br>Page 625d2f not present in the dump file. Type &quot;.hh dbgerr004&quot; for details<br>Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+13702 )<br><br>Followup: MachineOwner<br>---------</p>
<p>iv'e added the debugging tool to the firewall, and for some reason i still cant seem find memory.dmp . im running windows 8.1</p>
If i delete the dump files i.e memory.dmp or *.dmp any problem will occur to my system.
<p>Hello! just found this post and I am going to try it out now</p><p>I will be back if it didnt work x)</p>
<p>I will work if you follow the instructions :) The hard part if what do you do after you figure out what causes it!</p>
<p>Many thanks. This solved a random graphics driver crash on Windows 8.1 atikmpag.sys from AMD. Before that I tried changing antivirus but crash kept coming with fuzzy message (graphic card screwed up) so I could not read crash message. Opening MEMORY.DMP with Windbg had there in clear letters the name of the driver above. Old laptop with old driver. I tried AMD Catalyst Omega driver with High Performance Power and am hoping this will fix it. Otherwise frustrating that graphics card is not easily fixable.</p>
<p>You might try using an older version of the driver. I dont know much about amd drivers, but i wonder if you can figure out in what version it was that they changed that module and go one version before that. Might just be trial and error. </p>
<p>Is there a forum that you'd recommend people send there file/info?</p>
<p>Hi,</p><p>I followed your very clear instructions, but when I run Windbg I have the problem that the Symbols file path (entered in Step 6) cannot be found which generates a lengthy list of error messages. Any advice appreciated.</p><p>Regards,</p><p>Nogin</p>
<p>After looking at this again, the problem is that you actually pasted the 1. with the symbol path. You pasted &quot;1.SRV*C:\Windows\symbol_cache*http://msdl.microsoft.com/download/symbols&quot; when it should have been just &quot;SRV*C:\Windows\symbol_cache*http://msdl.microsoft.com/download/symbols&quot;</p>
<p>Hi NogintheNog,<br>Looks like your symbol path is correct...(according to this article http://support.microsoft.com/kb/311503) Are you connected to the internet? It needs to download the symbols from the net in order to work. If you are connected to the internet, make sure your firewall isn't blocking the debugger. Good Luck!</p>
<p>Why thanks, this helped me prove my suspicion (that skype is a buggy pos) :P<br>Skype was the process responsible (which is what I suspected because that's really the only thing that was running).</p>
<p>Ha! I love stories like this! It's really empowering being able to diagnose your own computer issues and fixing them. </p>
<p>so how did it go with the problem?</p>
<p>This one? It was actually a bug in Windows 8 that microsoft couldnt reproduce. It eventually went away, so something must have fixed it.</p>
<p>HI Azerial, Thanks for the helpful post. I have a question, that I hope you may help with. I have a Intel NUC D34010WYK with windows 8.1. And since the first initial install my OS will randomly freeze and just hang. i.e. spinning wheel, can not enter the task manager in any way, and eventually a window pops up &quot;Windows Not responding&quot;. I have done multiple installs of W8.1 with different dongles from my friends, but still the same result. Additionally if I leave the computer on for the day, my OS will crash and on will try to reboot automatically however when it reboots on it's own it cannot find a boot image. I've ran every test under the sun, Ram Mem test, SSD tests, and everything checks out. I have googled for a few weeks now, resorting to diagnosing the issue myself with these SDK tools. For some reason I don't get a Memory.dmp file, even though I have had a BSOD in the last couple of days. Would you have any recommendations on where to start to diagnose this issue/possibly create and capture a log of some sort when my OS hangs? </p><p>Any help is much appreciated. Thanks.</p>
<p>Hi PhenomHTPC,<br>While I can't give you any insight on why your computer is acting up, i can give you some advice on the dump file. </p><p>1. From the desktop, open Windows Explorer (tan folder at the right of the taskbar)<br>2. In the Windows Explorer address bar, type &quot;Control Panel&quot; and hit enter<br>3. In the search box on the upper right of the window, type in &quot;System&quot;<br>4. Click on the link that reads &quot;View advanced system settings&quot;<br>5. On the Advanced tab, click on the &quot;Startup and Recovery&quot; button<br>6. At the bottom of the window, there will be a &quot;System failure&quot; section<br>7. Validate the settings. I have attached a sceenshot of what mine looks like. You might also change the dump from Automatic to Complete. (Complete will give you a very large file, but eh its sometimes worth it if you need more info. Just don't forget to change it back)</p><p>Hope you figure out what it is!</p>
thank you for posting this and the reply back<br> i thought there was something for windows xp but mav been to busy working to check on it<br> again thanls

About This Instructable

552,364views

59favorites

License:

More by Azerial:How to Analyze a BSOD Crash Dump 
Add instructable to: