BSOD Analysis - Getting Started

Dave76 · 16 Oct 2012

For us non-escalation engineers, we need to find work arounds. It will take years to get the knowledge to use all the commands, in the end it comes to a lot of guess work.
Use usasma's sites I linked above, it has a lot of info links.
Search the stop codes to see what others are recommending.
A lot of crashes are cause by faulty hardware, old drivers (lmntsm command, for Win7 anything older than 14 July 09 needs updated), check the event logs for clues (use the find function 'errors').
As Vir Gnarus said a lot of the time the debugger can't tell you exactly what the problem cause is, it gives clues.
Get more information from the OP, Driver Verifier helps in a lot of situations.

Then, there a lot of different crashes pointing in several directions, several pages later, it's a bad mouse.

Like Vir Gnarus said, it's a detective game, chase the clues.

Golden · 16 Oct 2012

Yes, I don't want to end up hating it, that for sure.

I can see that !analyse -v can spit out the start for me, so now I've just got to learn the steps required to get to this point - the ultimate goal: (an example)

Code:

Usual causes:  Defective hardware (particularly memory - but not just RAM), Faulty system service, Antivirus,  Device driver, NTFS corruption, BIOS Probably caused by : memory_corruption ( nt!MiEmptyPageAccessLog+dc )

Golden · 16 Oct 2012

^Thanks Dave. I've had a look at those.

Really, for me (not even an informal qualification in IT, never mind escalators) its a case of working out some logical steps I can use. For example:

!analyse
google bugcheck etc.
!lmv etc.
etc.
etc.

Once I've worked that out, I'm stumble through anything, so I'll keep referring back through those links until its more familiar to me.

I found this, so I might have a play with that too:
http://windbg.info/apps/46-crashme.html

Dave76 · 16 Oct 2012

That's how most of us start, stumble along as best we can.

When you get stuck, ask for help. It won't take long to learn the direction to stumble in

Vir Gnarus · 16 Oct 2012

The common steps people use here like !analyze -v followed by lm and its variants (lmsm, lmvm) is a good start, but obviously a very limited approach, about the same as just getting a driver list with timestamps for the drivers. Don't forget that you're only going this route for the time being until you learn more, in which case you'll start using more commands and extensions to further your exploration. Don't get trapped into just doing it this way (in fact, some scripts people have made do it automatically!) as you'll end up stunting your growth.

Btw, if you or anyone has any questions like generating a hypothesis on the cause of a certain crash but don't know how to verify the hypothesis with the crashdump, don't hesitate to ask me. Also stuff like not understanding a certain output, how such-n-such works, etc., all that I'm willing to answer - to the best of my knowledge, of course. TBH, I would much rather get asked these questions than people asking me personally for assistance to solving a case. Better to teach them to fish than to give them food.

Layback Bear · 13 Nov 2012

Where can I find a list of commands.

Vir Gnarus · 13 Nov 2012

All WinDBG commands and extensions (aside from 3rd-party ones) are documented in the WinDBG help manual included with the application. You can open it up right from inside WinDBG. In fact, you can even type the command .hh <search term> right in the WinDBG prompt to open up the article closest in match to <search term>. For information to help use commands (prefixed with a period '.') you can type .help (the /D switch will also provide a DHTML alphabetical header to help find the command you want), and then when you find the command you desire, type .help <command> for info on it. This obviously does not apply to extensions (prefixed with a bang '!').

Layback Bear · 13 Nov 2012

Thank you Vir Gnarus for the information.

Dinesh · 12 Jan 2013

How can I downoad just the Windbg program? When I go to this link, it asks me to download the whole Windows SDK, which is of 1.2GB.

koolkat77 · 12 Jan 2013

Scroll down to this part:

Install Debugging Tools for Windows as Part of the Windows SDK

If you don’t need the WDK but you do need the Windows SDK, you can install Debugging Tools for Windows as part of the Windows SDK. In the installation wizard, be sure to select Debugging Tools.

Install Debugging Tools for Windows as part of the SDK

Which gives this link:

Windows Software Development Kit (SDK) for Windows 8

Download the sdksetup.exe

Quick Details

Version: Windows SDK for Windows 8
Windows ACK Version: 2.2
Date published: November 15, 2012
File name: sdksetup.exe

Installation file should take you to a page like this (See attachment):

BSOD Analysis - Getting Started-capture.png

Deselect everything except the debugging tools for windows.

Make sure you have net framework 4.5 installed.