A Simple Guide To Debugging System Crashes (BSOD etc)

stuartk

We have all seen the scenario. You are sitting in front of your system and suddenly it restarts or displays a blue screen with white text which means absolutely nothing to you
.
So what do you do? Where do you start? Do you run an anti-virus / spyware scan? Do you test the memory or hard disk? Is it a driver? If so which one? Could it be the last piece of software I installed? Where do we go from here?


Thankfully Microsoft have provided FREE tools that anyone can download to help debug their system and identify the crashing culprit.


Using this method WILL save you hours of time identifying system crash causes and technician fees



OK so lets get started.


First you have to set your system up so that it "records" what crashed. To do this in:
XP - Right click on My Computer and Select Properties then click Advanced then navigate down to Startup and Recovery and select Settings and look down at the System Failure part. First of all we want to Disable Automatic Restart and in Write debugging information choose Small memory dump (64k) as shown:





In Vista the step is pretty much the same except right click on My Computer, select properties then Advanced System Settings then Startup and Recovery Settings.


Once done click OK. Your system is now setup to record small memory dumps which can be used to identify system crash culprits.


Now you have to download the debugging tools from Microsoft
On this page there is a wealth of further information on debugging but for the purpose of this guide and for those new to debuging stop errors or crashes, I will keep it as simple as possible.


Now choose the version for your system and click the link. For this example i will choose the 32 bit debugging tool which is what most people will want unless you are using a 64 bit system. On the next page choose the latest / current release and save your download. Once downloaded double click to install. Click Next and accept the license agreement then select Complete then Install. Once done click Finish.
Now navigate to All Programs and select Debugging tools for Windows X86 and select WinDbg. You will now be presented with the following screen:




The go to File and select Symbol File Path. You will now be presented with an empty box. Type the following text EXACTLY as you see it:

This is telling the WinDbg program to look in C:\Websymbols for the appropriate symbols package required to debug your operating system version and if they aren't found then to download them to: C:\Websymbols .Once you have entered this click OK.
Go to File again and select Save Workspace
Go to File again and select Open A Crash Dump
The mini dump files should be located at C:\Windows\Minidump and have the extension .dmp
Select the most recent .dmp file (they are named by date).
If prompted to save again choose No
Windows de!!!!!! will now check for the appropriate symbols for your system and if they aren't present, will download them to C:\websymbols. Once it has downloaded these it will then process the crash dump file.
Once it has processed the mini dump, scroll down and you are looking for the item in Image Name:

That is what is crashing your system. In this example IMAGE_NAME: memory_management - it was a faulty RAM stick which I replaced and the system now works without crashing
Close WinDbg and save your workspace for future debugging.
And that's it.

Strider590

Had that (or very similar) memory problem before on an Asus motherboard, caused by a bug where the BIOS resets itself to factory settings and tries to run the DDR on the incorrect CAS-tRP-tRCD-tRAS setting's, in which case most DIMM's have the correct setting's printed on them.

There are also many many references online that contain the "BSOD" stop codes and list all the possible causes

stuartk

Strider590 wrote: »

Had that (or very similar) memory problem before on an Asus motherboard, caused by a bug where the BIOS resets itself to factory settings and tries to run the DDR on the incorrect CAS-tRP-tRCD-tRAS setting's, in which case most DIMM's have the correct setting's printed on them.

There are also many many references online that contain the "BSOD" stop codes and list all the possible causes

hi buddy

thats true but why spend ages trawling the net for a solution when you can debug it yourself and pinpoint the problem?

also most BSOD sites will say that a driver or some software etc is causing the problem - a general answer. reading the image name from WinDbg will accurately identify the crashing driver / software / hardware etc

regards

RobTang

While windbg is a very useful tool, I think its a bit over the head of a lot of people, and its not always clear what is casuing the error. eg. I had a fried northbridge and the debug files just pointed to normal driver errors.

and well ive never had much luck trying to get people to use this tool for diagnosis, they will always without fail try somthing else instead.

stuartk

RobTang wrote: »

While windbg is a very useful tool, I think its a bit over the head of a lot of people, and its not always clear what is casuing the error. eg. I had a fried northbridge and the debug files just pointed to normal driver errors.

and well ive never had much luck trying to get people to use this tool for diagnosis, they will always without fail try somthing else instead.

hi buddy

if your Northbridge is fried then you WILL get errors with the following: CPU,RAM, AGP, PCI Express etc. So yeah you would have been all over the place with that one and pretty hard to pinpoint unless you had a hardware testing tool. If you had corrected all the problems showing up by WinDbg and the problems still appeared then I would suspect a more sinister fault ie hardware. But again WinDbg would have pointed me in that direction.

That said, I understand that most people won't even have heard of WinDbg nevermind know how to use it but I think my guide is straight forward and easy to understand.

So I'd like to hear more from anyone getting results

regards

angie46y

after having a new harddrive put in, i had to send my pc back i was told it had overheated and it was restored back to nearly new i lost all my data, after a couple of hours my screen came up blue with white text , i have spent so much money do you think i would be better of getting a new tower i am a novice with computers and feel that i have been ripped of please advise thanks. angie

stuartk

hi there

thats terrible that you lost your data and it shouldnt have happened. probably one of the "format and reinstall fixes all" brigade just wiped it.

if you want i can connect to your pc and check whats causing it to crash

you shouldnt need a new tower or to spend any more money

regards

Wortle

Good grief stuart and strider...do you work nights? I cant get my head round computer probs at 3pm let alone 3am....if you dont work nights and you are insomniacs this is why! Get some hot chocolate and leave the keyboard be!;):coffee: