You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
description: Describes how to check a memory dump file by using Dumpchk.
4
-
ms.date: 01/15/2025
4
+
ms.date: 03/10/2025
5
5
manager: dcscontentpm
6
6
audience: itpro
7
7
ms.topic: troubleshooting
@@ -16,112 +16,31 @@ This article describes how to check a memory dump file by using Dumpchk.
16
16
17
17
_Original KB number:_ 156280
18
18
19
-
> [!NOTE]
20
-
> For a Microsoft Windows XP version of this article, see [315271](https://support.microsoft.com/help/315271).
21
-
22
19
## Summary
23
20
24
-
Dumpchk is a command-line utility you can use to verify that a memory dump file has been created correctly. Dumpchk does not require access to symbols.
25
-
26
-
Dumpchk is located in the following locations:
27
-
28
-
- Windows NT 4.0 CD-ROM: Support\Debug\\\<Platform>\Dumpchk.exe
29
-
30
-
- Windows 2000 CD-ROM: Install the Support Tools by running Setup.exe from the Support\Tools folder on the CD-ROM. By default, Dumpchk.exe is installed to the Program Files\Support Tools folder.
31
-
32
-
## Dumpchk command-line switches
33
-
34
-
Dumpchk has the following command-line switches:
35
-
36
-
DUMPCHK [options]\<CrashDumpFile>
37
-
38
-
- -? Display the command syntax.
39
-
40
-
- -p Prints the header only (with no validation).
41
-
42
-
- -v Specifies verbose mode.
43
-
44
-
- -q Performs a quick test. Not available in the Windows 2000.
45
-
46
-
Additional switches that are only available in Windows 2000 Dumpchk.exe version:
47
-
48
-
- -c Do dump validation.
21
+
Dumpchk is a command-line utility you can use to verify that a memory dump file was created correctly. If a memory dump file is corrupt, it can't be analyzed in a debugger. Using Dumpchk to verify a dump file is in a good state is helpful. It saves time and effort in uploading corrupt dump files to be analyzed by support professionals. Dumpchk doesn't require access to symbols.
49
22
50
-
- -x Extra file validation. Takes several minutes.
23
+
Dumpchk is part of the Windows Debugging Tools. There are two versions of the Windows Debugger. To use Dumpchk, you must install the version of the Windows Debugging Tools included in the [Windows SDK](https://developer.microsoft.com/en-us/windows/downloads/windows-sdk/):
51
24
52
-
- -e Do dump exam.
25
+
1. Download the SDK installer.
26
+
2. Launch the installer, and then select **Windows Debugging Tools** with other components that you would like to install.
27
+
3. After the installation completes, dumchk.exe is in the directory that you installed the Windows Debugging in. Use the version that matches your hardware platform.
53
28
54
-
- -y \<Path> Set the symbol search path for dump exam.
55
-
- If the symbol search path is empty, the CD-ROM
56
-
- is used for symbols.
29
+
When Dumpchk runs, it displays some basic information from the memory dump file, then verifies all the virtual and physical addresses in the file. There are many symbol errors if a symbol path isn't specified. Those errors can be ignored as we're checking the dump file for corruption. Dumpchk reports any errors that are found in the memory dump file.
57
30
58
-
- -b \<Path> Set the image search path for dump exam.
59
-
- If the symbol search path is empty, \<SystemRoot>\system32
60
-
- is used for symbols.
31
+
If there's an error during any portion of the output displayed, the dump file is corrupted, and analysis can't be performed.
61
32
62
-
- -k \<File> Set the name of the kernel to File.
63
-
64
-
- -h \<File> Set the name of the hal to File.
65
-
66
-
Dumpchk displays some basic information from the memory dump file, then verifies all the virtual and physical addresses in the file. If any errors are found in the memory dump file, Dumpchk reports them. The following is an example of the output of a Dumpchk command:
67
-
68
-
```output
69
-
Filename . . . . . . .memory.dmp
70
-
Signature. . . . . . .PAGE
71
-
ValidDump. . . . . . .DUMP
72
-
MajorVersion . . . . .free system
73
-
MinorVersion . . . . .1057
74
-
DirectoryTableBase . .0x00030000
75
-
PfnDataBase. . . . . .0xffbae000
76
-
PsLoadedModuleList . .0x801463d0
77
-
PsActiveProcessHead. .0x801462c8
78
-
MachineImageType . . .i386
79
-
NumberProcessors . . .1
80
-
BugCheckCode . . . . .0xc000021a
81
-
BugCheckParameter1 . .0xe131d948
82
-
BugCheckParameter2 . .0x00000000
83
-
BugCheckParameter3 . .0x00000000
84
-
BugCheckParameter4 . .0x00000000
85
-
86
-
ExceptionCode. . . . .0x80000003
87
-
ExceptionFlags . . . .0x00000001
88
-
ExceptionAddress . . .0x80146e1c
89
-
90
-
NumberOfRuns . . . . .0x3
91
-
NumberOfPages. . . . .0x1f5e
92
-
Run #1
93
-
BasePage . . . . . .0x1
94
-
PageCount. . . . . .0x9e
95
-
Run #2
96
-
BasePage . . . . . .0x100
97
-
PageCount. . . . . .0xec0
98
-
Run #3
99
-
BasePage . . . . . .0x1000
100
-
PageCount. . . . . .0x1000
101
-
102
-
**************--> Validating the integrity of the PsLoadedModuleList
103
-
**************--> Performing a complete check (^C to end)
104
-
**************--> Validating all physical addresses
105
-
**************--> Validating all virtual addresses
106
-
**************--> This dump file is good!
107
-
```
108
-
109
-
If there is an error during any portion of the output displayed above, the dump file is corrupted and analysis cannot be performed.
110
-
111
-
In this example, the most important information (from a debugging standpoint) is the following:
33
+
When Dumpchk finishes, it displays the stop code and some parameters.
This information can be used to determine what Kernel STOP Error occurred and, to a certain extent, what version of Windows was in use.
126
-
127
-
The information in this article is from the Windows NT Resource Kit. For more information on Dumpchk.exe and other debugging utilities, see Appendix A in the Windows NT 3.51 Resource Kit Update and Update 2.
0 commit comments