6

I see you have succussfully answered this question previously but it is not specific to my system. I have downloaded your file and created the relevant dump file but I don't know how to analyse it. Can I upload it to you for some advice please?

magicandre1981
  • 97,301
  • 30
  • 179
  • 245
Pauline Lawson
  • 71
  • 1
  • 2

1 Answers1

11

To diag a Windows Explorer crash, you need to generate a crash dump first. You can use the Windows Error Reporting service for this since Vista SP1.

Starting with Windows Server 2008 and Windows Vista with Service Pack 1 (SP1), Windows Error Reporting (WER) can be configured so that full user-mode dumps are collected and stored locally after a user-mode application crashes. Applications that do their own custom crash reporting, including .NET applications, are not supported by this feature.

To configure Windows Error Reporting, you have a few options. You can follow the steps written by Microsoft or just import my .reg file. Alternatively you can use procdump:

procdump -mp explorer.exe -i C:\explorer_dumps\

All of the above just configure Windows to write a dump file whenever explorer.exe crashes. Now wait for explorer to crash again.

To analyze this crash dump or memory dump (.dmp) from a bugcheck/BSOD, you need to install Windbg, which is part of the Windows 10 SDK.

enter image description here

  • Run windbg.exe (x86) (if you use a 32Bit Windows) or windbg.exe (x64) (if you use a 64Bit Windows)
  • Inside Windbg.exe, click on file->Open crash dump (CTRL+D> and open the generated dump file (.dmp).

  • After you loaded the dmp inside Windbg.exe, click on file->Symbol File Path and configure Windg to use debug symbols:

    SRV*c:\symbols*http://msdl.microsoft.com/download/symbols

  • now type !analyze -v in the command box at buttom and press ENTER:

    enter image description here
    Now Windbg load the debug symbols and analyses the dump. Look here for 3rd party DLLs like in my example here where psdprotect.dll causes the crash.

Fidel
  • 451
  • 2
  • 7
  • 18
magicandre1981
  • 97,301
  • 30
  • 179
  • 245
  • Thank you for this information. I have generated the dump file and zipped it. I am using Windows 7 though so am unsure if I can download this windbg.exe file to attempt debugging myself. – Pauline Lawson Jul 23 '17 at 14:20
  • should be able to use Windbg in windows 7. if you need help, upload the zipped dump (onedrive, dropbox) and post the share link here – magicandre1981 Jul 23 '17 at 15:38
  • @magicandre1981 Excellent answer. It would be good if you were to write a *canonical question and answer* about analysing dmp files, combining this with your other answer. Can you consider doing this please? – DavidPostill Jul 27 '17 at 07:27
  • @DavidPostill what should I do? ‍♂️ – magicandre1981 Jul 27 '17 at 15:28