6

I see you have succussfully answered this question previously but it is not specific to my system. I have downloaded your file and created the relevant dump file but I don't know how to analyse it. Can I upload it to you for some advice please?

Improve this question
3
  • 3
    Which previous question are you referring to?
    – Xavierjazz
    Jul 20, 2017 at 14:35
  • @Xavierjazz I think the user means me, I've answered several questions in the past about this.
    – magicandre1981
    Jul 23, 2017 at 6:18
  • Sorry, I was referring specifically to the post found here; superuser.com/questions/524263/…
    – Pauline Lawson
    Jul 23, 2017 at 14:07

1 Answer 1

Reset to default
10

To diag a Windows Explorer crash, you need to generate a crash dump first. You can use the Windows Error Reporting service for this since Vista SP1.

Starting with Windows Server 2008 and Windows Vista with Service Pack 1 (SP1), Windows Error Reporting (WER) can be configured so that full user-mode dumps are collected and stored locally after a user-mode application crashes. Applications that do their own custom crash reporting, including .NET applications, are not supported by this feature.

To configure Windows Error Reporting, you have a few options. You can follow the steps written by Microsoft or just import my .reg file. Alternatively you can use procdump:

procdump -mp explorer.exe -i C:\explorer_dumps\

All of the above just configure Windows to write a dump file whenever explorer.exe crashes. Now wait for explorer to crash again.

To analyze this crash dump or memory dump (.dmp) from a bugcheck/BSOD, you need to install Windbg, which is part of the Windows 10 SDK.

enter image description here

  • Run windbg.exe (x86) (if you use a 32Bit Windows) or windbg.exe (x64) (if you use a 64Bit Windows)
  • Inside Windbg.exe, click on file->Open crash dump (CTRL+D> and open the generated dump file (.dmp).

  • After you loaded the dmp inside Windbg.exe, click on file->Symbol File Path and configure Windg to use debug symbols:

    SRV*c:\symbols*http://msdl.microsoft.com/download/symbols

  • now type !analyze -v in the command box at buttom and press ENTER:

    enter image description here
    Now Windbg load the debug symbols and analyses the dump. Look here for 3rd party DLLs like in my example here where psdprotect.dll causes the crash.

Improve this answer
4
  • Thank you for this information. I have generated the dump file and zipped it. I am using Windows 7 though so am unsure if I can download this windbg.exe file to attempt debugging myself.
    – Pauline Lawson
    Jul 23, 2017 at 14:20
  • should be able to use Windbg in windows 7. if you need help, upload the zipped dump (onedrive, dropbox) and post the share link here
    – magicandre1981
    Jul 23, 2017 at 15:38
  • @magicandre1981 Excellent answer. It would be good if you were to write a canonical question and answer about analysing dmp files, combining this with your other answer. Can you consider doing this please?
    – DavidPostill ♦
    Jul 27, 2017 at 7:27
  • @DavidPostill what should I do? 🤷‍♂️
    – magicandre1981
    Jul 27, 2017 at 15:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.