Dumpchk is Version Specific in Windows NT 4.0

• Microsoft Windows NT Workstation versions 3.5, 3.51, and 4.0
• Microsoft Windows NT Server versions 3.5, 3.51, and 4.0

SUMMARY

The Windows NT 3.51 Dumpchk.exe program will produce erroneous output if it is run against a memory dump generated by a Windows NT 4.0 installation. Inaccurate and unpredictable results will be in the dumpchk validation report as shown below.

NOTE: There is no size limitations on memory dump files that dumpchk.exe can run against. Dump files as large as 1GB has been tested with accurate results.

************** **************--> Validating the integrity of the PsLoadedModuleLi ************** Error: could not read base of PsLoadedModuleList

************** **************--> Performing a complete check (^C to end) ************** ************** **************--> Validating all physical addresses ************** ************** **************--> Validating all virtual addresses **************

Total errors = xx

-or-

**************

     **************--> Performing a complete check (^C to end)
     **************

     **************
     **************--> Validating all physical addresses
     **************
     **************
     **************--> Validating all virtual addresses
     **************
     Error: memory read failed 0x80600000 pfn=400 pde=201, pte=200
     ptepage=5617000 vapage=5298000 loc=38000
     Error: memory read failed 0x80601000 pfn=400 pde=201, pte=201
     ptepage=5617000 vapage=5298000 loc=38000

MORE INFORMATION

The Dumpchk.exe utility is backwards compatible. Versions of dumpchk equal or greater than the version of Windows NT where the memory dump was generated needs to be used.

In cases where dumpchk is run against incomplete memory dumps (system is transferring the dump to pagefile or from pagefile to %SystemRoot%\Memory.dmp) similar inaccurate results will be included in dumpchk output.