How to Debug with A Usermode Crash Dump

• Microsoft Windows NT Workstation versions 3.51 and 4.0
• Microsoft Windows NT Server versions 3.51 and 4.0

SUMMARY

One of the new features introduced in Windows NT 3.51 was the ability for the operating system to write a user mode crashdump of a user mode process that crashed. This article details how to configure Windows NT to write this file and how to begin analyzing this file.

MORE INFORMATION

Configuring Windows NT to Write a User Mode Crashdump

1. To enable the system exception handler to write a user mode dump, run drwtsn32 from a command prompt.

2. Under Options, check Create Crash Dump File and Dump All Thread Contexts.

   Note: It is not recommended to check 'Dump Symbol Table' unless necessary.

Loading a User Mode Crash Dump Into Windbg

1. Start Windbg from the command prompt or an icon. Go to Program Open New. Browse to the User.dmp file (in %SystemRoot% by default) and click OK twice.

2. From the Options menu, click Debug... Uncheck Ignore Bad Symbols.

3. From the Options menu, click User Dlls... Fill in the Symbol Search Path.

   NOTE: You can use multiple paths separated by semicolon. Also, you can select Load under the Symbols section and then hit Default under the Default section. This will force the symbols to be validated.

4. Click OK.

5. Finally, from the Run menu, click Restart to begin processing the dump file.

Basic Commands

Look at the current stack trace (k, kv, or kb) and debug much like you would debug a kernel mode crash dump. The ~ key will give the active threads~2 will switch to the 2nd thread Lm (load modules) is similar to !drivers. Several of the kernel mode commands and extensions work on the user mode debugger side, type in help for a complete list of commands.

Miscellaneous

If the user dump does not load properly, delete the following key in the registry and re-run windbg:

WARNING: Using Registry Editor incorrectly can cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that problems resulting from the incorrect use of Registry Editor can be solved. Use Registry Editor at your own risk.

For information about how to edit the registry, view the "Changing Keys And Values" Help topic in Registry Editor (Regedit.exe) or the "Add and Delete Information in the Registry" and "Edit Registry Data" Help topics in Regedt32.exe. Note that you should back up the registry before you edit it.

1. Run Registry Editor (Regedt32.exe)

2. Delete the HKEY_CURRENT_USER\Software\Microsoft\windbg key.

3. Restart your computer.

The Drwtsn32.log file located in %SystemRoot% can be very helpful also. This log file corresponds to the User.dmp. It displays all threads in detail for the process in which the exception occurred. To find the thread that failed, search for FAULT. Also, the thread IDs in the Drwtsn32.log can be correlated to the thread IDs in the User.dmp by counting the threads from the top of the log starting with 0.

For additional information, please see the following article in the Microsoft Knowledge Base:

   ARTICLE-ID: Q158715
   TITLE     : User Mode Dump Files Must be Debugged on Same Architecture

   ARTICLE-ID: Q150334
   TITLE     : WINDBG.EXE Removed From \SUPPORT\DEBUG\<platform> on Server CD

   debugref