Crash dump analysis guides

How to read Windows crash dumps and Linux core dumps yourself: which file to look at, which commands to run, and what common stop codes mean. Written by the people building DumpTriage.

Getting started

• Find the crash dump, set up symbols and read !analyze -v

  Find a Windows crash dump, load it in WinDbg with Microsoft symbols, and read !analyze -v: bugcheck code, faulting module, stack. Kernel BSOD dumps and application dumps.

• Linux core dumps with gdb and kdump vmcores with crash

  Capture a Linux process core dump (core_pattern, systemd-coredump), get a backtrace with gdb, and read a kernel kdump vmcore with the crash utility.

Windows stop codes

• 0x9F DRIVER_POWER_STATE_FAILURE

  What stop code 0x9F DRIVER_POWER_STATE_FAILURE means, what each parameter tells you, and the WinDbg commands that find the driver holding the power IRP.

• 0xD1 DRIVER_IRQL_NOT_LESS_OR_EQUAL

  What stop code 0xD1 DRIVER_IRQL_NOT_LESS_OR_EQUAL means, how to read its four parameters, and the WinDbg commands that point at the faulting driver.

• 0x133 DPC_WATCHDOG_VIOLATION

  What stop code 0x133 DPC_WATCHDOG_VIOLATION means, the difference between Parameter 1 = 0 and 1, and the WinDbg commands that find the driver stuck at DISPATCH_LEVEL.