Microsoft optimize

How do I use WinDBG Debugger to troubleshoot a Blue Screen of Death?

Microsoft's WinDBG will help you to debug and diagnose a BSOD problem and then lead you to the root cause so you can fix it.
By Jacky Howe Have you ever wondered how to obtain extra information from the infamous Blue Screen of Death (BSOD) that will sometimes show up and give you a cryptic, Stop: 0x00000000 error message, before flashing off the screen. The error message is trying to point you to a fatal operating system error that could be caused by a number of problems.

Microsoft's WinDBG will help you to debug and diagnose the problem and then lead you to the root cause so you can fix it.

This blog post is also available in PDF format as a free TechRepublic download.

Steps in a nutshell

  1. Create and capture the memory dump associated with the BSOD you are trying to troubleshoot.
  2. Install and configure WinDBG and the Symbols path to the correct Symbols folder.
  3. Use WinDBG to Debug and analyze the screen dump, and then get to the root cause of the problem.

Create memory dump

Keep in mind that if you are not experiencing a blue screen fatal system error, there will be no memory dump to capture.

1. Press the WinKey + Pause.

2. Click Advanced, and under Start Up and Recovery, select Settings.

3. Uncheck Automatically Restart.

4. Click on the dropdown arrow under Write Debugging Information.

5. Select Small Memory Dump (64 KB) and make sure the output is %SystemRoot%\Minidump.

6. Restart the PC normally, as this will allow the System to error and Blue Screen and then create the Minidump.

The location of the Minidump files can be found here:

C:\WINDOWS\Minidump\Mini000000-01.dmp

To download and install the Windows debugging tools for your version of Windows, visit the Microsoft Debugging Tools Web site.

Follow the prompts, and when you install, take note of your Symbols location, if you accept the default settings. I normally create a folder first and then direct the install to that folder because I use WinDBG for two operating systems, XP and Vista, and want to keep them separate and organized.

This Microsoft Support Knowledge Base article will explain how to read the small memory dump files that Windows creates for debugging purposes.

Setting up and using WinDBG

1. Click Start | All Programs | Debugging Tools for Windows, and open WinDBG. Select File | Symbol file path and modify it to suit your situation, then copy and paste it into the box, as shown in Figure A, and click OK. I suggest:

SRV*c:\symbols*http://msdl.microsoft.com/download/symbols

Or if you are using different Symbols:

SRV*c:\Vistasymbols*http://msdl.microsoft.com/download/symbols

SRV*c:\XPsymbols*http://msdl.microsoft.com/download/symbols

Figure A

Symbol Path
2. Close the workspace and save the Workspace information, as shown in Figure B. This should lock in the Symbol path.

Figure B

Workspace

3. Open WinDBG and select File and select Open Crash Dump and then navigate to the minidump file created earlier, highlight it, and select Open.

Click on:

! analyze -v

as shown in Figure C under Bugcheck Analysis.

Figure C

! analyze -v
Tips! If you look to the bottom of the screen, you will see kd>; to the right of that type !analyze -v or .lastevent and press the Enter key. It will then show you the exception record and stack trace of the function where the exception occurred.

You can also use the .exr, .cxr, and .ecxr commands to display the exception and context records.

When working with drivers, you can use kd> lm tn, as shown in Figure D, to get extra information.

[Ctrl]+[A] will let you copy the information and paste it into Notepad.

Figure D

kd>
For example, look to the bottom of the page for information similar to what is shown in Figure E.

Figure E

Stack trace

Conclusion

The problem creating the BSOD was caused by the installed dialer software for a USB modem. It turned out that uninstalling the software didn't resolve the problem.

The answer to the problem was achieved by using the WinDBG tool to Debug and analyze the memory dump file. The fix was to rename the C:\Windows\System\fldevice.sys driver to C:\Windows\System\fldevice.sys.old. Windows was still referencing the file even though the software had been uninstalled. This tool is invaluable and will help you to resolve the problems that you may encounter when you get a BSOD.

Stay on top of the latest XP tips and tricks with TechRepublic's Windows XP newsletter, delivered every Thursday. Automatically sign up today!

33 comments
campbell81
campbell81

I try to open the crash dump file but it wont let cause im not the adminastrator. Im the only user on this comp. How can i open it as the adminastrator??

tybarwick
tybarwick

After clicking the !analyze -v what next? I received a bunch more cryptic text but still not sure what's causing the BSOD. The article doesn't say how to locate the offending file. Seems like some steps were skipped. The only thing I got next was another link for hardware disk. What's that mean. I need to upgrade the firmware? Run a chkdsk?

mikef
mikef

I have the dump file, what do I do to fix the problem? STACK_TEXT: 8059dd6c 826643fb 0000009f 00000003 8707c030 nt!KeBugCheckEx+0x1e 8059ddc8 82664018 8059de40 8059def0 805d3001 nt!PopCheckIrpWatchdog+0x1ad 8059de08 826dd30b 827414e0 00000000 8e810380 nt!PopCheckForIdleness+0x343 8059df28 826dcecb 8059df70 8272b902 8059df78 nt!KiTimerListExpire+0x367 8059df88 826dd635 00000000 00000000 00299c67 nt!KiTimerExpiration+0x22a 8059dff4 826db2f5 8d15bb60 00000000 00000000 nt!KiRetireDpcList+0xba 8059dff8 8d15bb60 00000000 00000000 00000000 nt!KiDispatchInterrupt+0x45 WARNING: Frame IP not in any known module. Following frames may be wrong. 826db2f5 00000000 0000001b 00c7850f bb830000 0x8d15bb60 STACK_COMMAND: kb FOLLOWUP_NAME: MachineOwner FAILURE_BUCKET_ID: 0x9F_3_IMAGE_usbhub.sys BUCKET_ID: 0x9F_3_IMAGE_usbhub.sys Followup: MachineOwner

Jeremyjd0531
Jeremyjd0531

I am stuck from the beginning. I have installed windbg, but what is winkey + pause . I have a dell xps, and I cannot figure this out. I have a insert/pause button, although this does not bring up anything.??

paganiniy
paganiniy

Jacky - well done! I haven't see BSOD for years (win xp). How can I force my win xp to produce any BSOD - just for testing? Thanks.

andrew.crook
andrew.crook

Most of the time the result from analyze -v is incorrect and reports the incorrect culprit from the stack frame due to the heuristics used in analysis. Also you really need to do a kernel memory dump to get the required information. System internals did a great conference in 2006 on this.

MrHRoark
MrHRoark

I am right with you until this solution seems to assume that one can get PAST the BSOD to the programs button, download the debugger, etc? Wouldn't that mean that Windows is working? How about if you can't do that--now what?

seanferd
seanferd

Thanks, Jacky. I haven't done this in a long time. As a matter of fact, I don't think I've even decompressed the symbols package on this machine.

etafner
etafner

NOW we are talking! Yeah, memory dumps 101! Excellent, might get people warmed up to debug more and more. You can tell almost every thing that was happening on the OS when it crashed. (By the way, if you don't want to get to the trouble of debugging, call Microsoft's Professional Support Services. The call for debugging blue screens is (or was) free.)

Mark W. Kaelin
Mark W. Kaelin

How do you debug a blue screen fatal system error? Or do you even try to debug it?

PurpleSkys
PurpleSkys

you will need that person to give you admin rights

seanferd
seanferd

The article went on at length about an offending file. Of course, there is no guarantee that your problem is a file or reference problem. My first suggestion would be that you not bother with debugging if you have no technical experience, or if you aren't technically inclined, or if you can't look up references at the MS site or others. This article, and site in general, is geared toward professionals, so you may get lost if you have no IT background. Did you try looking up the BSOD code itself? Frequently, that is sufficient, and debugging is just unnecessary work. "The only thing I got next was another link for hardware disk." I couldn't make any sort of decent guess without any background or debug data for your problem. Again, just looking up the STOP code is always the best first step. For further help, open your very own Question, since most folks won't be stopping back at this older article. You can add a link to this article and thread for extra background. Post the STOP code (you could even use it for the post title), and tell us what OS, edition, and service pack level you are using. I'm sure we can point you in the right direction. :)

?/\/\?|???\/???
?/\/\?|???\/???

...or what OS you use, but you may wish to have a look at... The shutdown process does not finish, and you receive an error message on a computer that is running Windows Vista or Windows Server 2008: "Stop 0x0000009F" http://support.microsoft.com/kb/972109

Jeremyjd0531
Jeremyjd0531

Possibly you could tell me what menu this winkey + pause would in fact bring up?

Jacky Howe
Jacky Howe

Open WinDBG and press F1 for help Forcing a System Crash from the Keyboard A system crash can be directly caused from most keyboards. In Windows XP and later, this feature is available on i8042prt ports (PS/2 keyboards). In addition, it is available on USB keyboards only in Windows Server 2003 (with Service Pack 2 or later, or with Service Pack 1 if the hotfix available with KB 244139 is installed). Two preparations must be made before this can be done: If you wish a crash dump file to be written, you must enable such dump files, choose the path and file name, and select the size of the dump file. For details, see Enabling a Kernel-Mode Dump File. With PS/2 keyboards, you must enable the keyboard-initiated crash in the registry. In the registry key HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\i8042prt\Parameters, create a value named CrashOnCtrlScroll, and set it equal to REG_DWORD 0x1 (or any nonzero value). With USB keyboards (Windows Server 2003 only, with Service Pack 2 or later, or with Service Pack 1 if the hotfix is installed), you must set the registry key HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\kbdhid\Parameters and create a value named CrashOnCtrlScroll, and set it equal to REG_DWORD 0x1 (or any nonzero value). Note There is a limitation with the Kbdhid.sys driver that allows you to generate the memory dump process by using a USB keyboard. The CTRL+SCROLL LOCK+SCROLL LOCK keyboard shortcut does not work if the computer stops responding at a high interrupt request level (IRQL). This limitation exists because the Kbdhid.sys driver operates at a lower IRQL than the i8042prt.sys driver. For more information on using this feature with the USB keyboards, refer to the article Generate a memory dump file by using the keyboard (KB 244139). The system must be rebooted before these changes will take effect. After this has been done, the keyboard crash can be initiated as follows. Hold down the rightmost CTRL key, and press the SCROLL LOCK key twice. It is possible for a system to freeze in such a way that this CTRL+SCROLL LOCK+SCROLL LOCK sequence will not work. However, this should be a very rare occurrence. The CTRL+SCROLL LOCK+SCROLL LOCK crash initiation will work even in many instances where CTRL+ALT+DELETE does not work. The system then calls KeBugCheck and issues bug check 0xE2 (MANUALLY_INITIATED_CRASH). Unless crash dumps have been disabled, a crash dump file is written at this point. If a kernel debugger is attached to the frozen machine, the machine will break into the kernel debugger after the crash dump file has been written. If it doesn't work send me a PM and I will fix you up with a few minidump files.

Jacky Howe
Jacky Howe

If the System is not starting up so that you can access the minidump file, you will need to use a Bootable Recovery CD, to be able to gain access to the minidump files. You will need to copy the minidump files from a non functioning System, to a System that has WinDBG installed to enable you to debug the information. Follow the instructions below to create the CD. This Recovery CD will work for Windows XP and Windows Vista: Creating a Windows Vista Recovery CD http://blogs.techrepublic.com.com/window-on-windows/?p=622 You can then use the command console to copy the files to a USB drive or memory stick. Boot from the Vista CD and on the first screen click Next, click Repair your computer, click Next and select Command Prompt. Type in the text below and press enter: copy C:\WINDOWS\Minidump\*.dmp (drive letter)f: or (drive letter)f:\folder name Tip! the USB device that you are writing to will have to be formatted as FAT32.

seanferd
seanferd

You just look them up. Have a recover disk handy?

Jacky Howe
Jacky Howe

I really do try to keep things simple. ;)

mytmous
mytmous

FYI: You can still begin the debug process as described in the article. The one catch is that in the case of some fatal BSOD's, the system doesn't have time to write the dump file before rebooting or locking. In those cases, you can utilize the live debugging method if you're comfortable with in that environment. Of course, all of this becomes a LOT more effective and timely if you have access to MS source code (some do - others will never have it).

campbell81
campbell81

I am the admin user though thats why it doesnt make sense?? I get you dont have the permision to open this file, contact the file owner or admin to obtain permission. Driver_irql_not_less_or_equal thats the blue screen error i get. I downloaded a new graphics driver the other day cause i heard that could be the issue, but still blue scree of death happens every so often once a couple of days. That's why im trying to open this and pop it into debugger to find out the exact problem. I have no viruses, or malware and my registry is fine.... Any thoughts would be appreciated. Thank you

mikef
mikef

Vista is the OS. I get the blue screen and the machine immediately reboots and says windows shut down from an unexpected failure. Then I look at the minidump and always get one that is usb related. The drivers are all up to date. Thanks for the reply, Mike

ts1998
ts1998

That is the same as right clicking on the 'My Computer' icon, and then selecting 'Properties'. It is simply a Windows Key 'Hot Key' for the same function.

brad
brad

Thanks Jacky. My son's Dell 8400 gets the dreaded BSOD, but the OS hangs at that point and will not carry on. So I replaced the HD and re-installed the OS by the Dell recovery disc. Even flashed the BIOS (didn't think that would work, tho). Still BSOD. I'll try your suggestion... Brad

MrHRoark
MrHRoark

Thanks Jacky...I really appreciate your sharing this info. I have two laptops...and no disks for the older...hurricanes and all....and its the one with the BSOD. Just so I am sure...the link you provided will work on Win XP as well? That is what I am using. Hope you and yours have a great Christmas.

lenardsabado
lenardsabado

how? teach step by step so that i can follow,,

PurpleSkys
PurpleSkys

in with the admin account? Sometimes that's all it takes

jeremyjd
jeremyjd

It took me a while to get this, although I have figured this out. There if a Fn key next to the window hot key, which is really a shift key, stands for function, or second function really. This opens the correct window. Thank you for the help, hope it warms up for you. Jeremy

ts1998
ts1998

I had to fire up the fireplace last night. Warm is relative. LOL. BTW, I just thought of something. There are on some keyboards 2 Windows keys, one for the main (Start) and the other for sub-menus. Make sure you are holding down the main Windows key. It is usually the one on the left. Holding that down, along with the Pause or Pause\Break key should bring up this dialog window.

Jeremyjd0531
Jeremyjd0531

Thank you for the reply. Blow some of that warm air from Jacksonville up here to Michigan could you? Jeremy

Jacky Howe
Jacky Howe

access to Windows XP Pro and Windows Home using the Recovery CD and I didn't have any problems accessing the folders to copy files. The other alternative is to remove the hard drive and use a USB Adaptor. USB 2.0 to IDE / SATA Adapter Cable 80cm (Supports 2.5" & 3.5" IDE) Example: http://www.skycomp.com.au/product.aspx?id=89551 And a Merry Christmas to you and your family.