Windows Symbols and Dump Analysis (Quick Steps)

Introduction

Most of us get situation where our application crash on non development machine. At that time we either look for remote debugging or dump analysis technique. Some developers are very friendly with these techniques while other do Google, read some blogs and perform steps. Second approach usually takes time. Below I am trying to list down some quick required steps for dump analysis. For remote debugging I already briefed them around 3+ years back at Remote Debugging: Quick Steps[^] and I still refer them whenever required.

Installing Debugging Tools for Windows

Download and install Debugging Tools for windows dbg_x86_6.11.1.404.msi or later build number depending on platform (approx 17 MB) from Download and Install Debugging Tools for Windows[^]

Installing Symbols (PDB files)

Install OS symbols by using following command:

symchk /r c:\windows\system32 /s SRV*c:\symbols\*http://msdl.microsoft.com/download/symbols 

In this command “c:\symbols” is your symbol directory. This could be anything whatever is your symbol location. This command may take hour’s time to finish and it download more than 700 MBs. Better you run it overnight.

Set system variable _NT_SYMBOL_PATH to symsrv*symsrv.dll*c:\Symbols*http://msdl.microsoft.com/download/symbols

Generating DUMP file

Using ADPlus

To attached debugger with your executable which is causing crash use following command at command prompt from the location where you installed Debugging Tools (typically C:\Program Files\Debugging Tools for Windows (x86), ADPlus is a vbscript file).

ADPlus -crash -pn iexplore.exe -o C:\dump 

Where iexplore.exe is the process name for which you want to observe the crash C:\dump is location where CDB.exe will create log and dump files.

Using Task Manager

Use Task Manager, right click on the process and choose Create Dump File (useful for a hang process). You can configure dump type from Control Panel using System > Advanced tab, and then click Settings under Startup and Recovery. Choose “Write debugging information” dropdown to change the dump type and location.

Analyzing Dump file

Using Visual Studio

Once we have the dump files, open it in Visual Studio using Open Solution option and start debugging to see the stack trace and local variables etc.

Using dumpchk command

Use dumpchk command at command prompt

dumpchk -y C:\symbols mydumpfile.dmp > dump.txt 

References

Use the Microsoft Symbol Server to obtain debug symbol files[^]

How to read the small memory dump files[^]

How to Analyze a Dump File[^]