Geek Answers Handbook

How to get a memory dump after a blue screen

I get an excellent BSOD when loading ( STOP: 0x0000007E ) from the driver I am writing and would like to load a memory dump for analysis. However, it is not dumped anywhere. Everything is configured correctly in the Startup and Recovery settings, but I do not receive any dump file, and nothing happened in the event log indicating the dump. It seems that the dump does not even occur ...

I know the exact line of code that calls it (calling IoAttachDevice() ), but I'm not sure why I would like to look at the output of DbgPrint to see exactly where it does not work. Perhaps Windows may crash before reset functions are configured? If so, how do I access the state of the machine when a failure occurs?

UPDATE: Other useful information: I am running Windows XP through VirtualBox on a Linux host.

+4
source share
3 answers

I don’t know why you don’t get the dump file, but if you have ready access to the machine, attach the kernel debugger to it to reproduce the error - you will be left with the machine sitting in the debugger ready to work (you can force the debugger to create the file dump for you if you also want to debug offline).

+2
source

Right-click on "my computer", select "Advanced", in the "Startup and Recovery" section, click "Settings". select "kernel memory dump" or "full memory dump".

+1
source

What is the initial setup of your driver? If it starts too early in the boot order, the file system may not be rebuilt using read-write, and therefore there should be no place for a dump.

Drivers under development usually should not be set to autostart until you get the driver stable when loading later. Of course, in the end, you need to set it to start automatically so that you can verify that it works correctly, but this happens later.

+1
source

More articles:


All Articles