DUMPEXAM.EXE is a command-line utility that examines a memory dump file, extracts information from it, and writes it to a text file. This text file can then be used by support personnel to determine the cause of the STOP error. In many cases, the analysis provided by DUMPEXAM provides enough information for support personnel to determine the cause of the error, without direct access to the dump file.
Three files are required to run DUMPEXAM, and they all must be in the same directory. You can find them on the Windows NT Server or Windows NT Workstation CD in the directory \SUPPORT\DEBUG\platform, where platform is I386, ALPHA, MIPS, or PPC. The first two files are:
The third file is one of the following, depending on the type of computer on which the dump file was generated:
If you have not applied any hotfixes or service packs to Windows NT 3.51, and the memory dump file you want to examine is in the location specified in the Recovery dialog box in the System option in Control Panel, then you can simply run DUMPEXAM directly off the CD with no parameters. This creates a text file called MEMORY.TXT, located in the same directory as the MEMORY.DMP file, that contains information extracted from the dump file.
You can also use DUMPEXAM to examine dump files created on computers running earlier versions of Windows NT. However, it will only run on a system running Windows NT 3.51, so you will need to move the dump file or access it over the network. Additionally, you will need to replace the KDEXT*.DLL files listed above with copies from the version of Windows NT that was running on the trapping (or target) system. These files contain debug information specific to that version of Windows NT.
The syntax for DUMPEXAM is as follows:
dumpexam [options] [CrashDumpFile]
where
-?
Displays the command syntax.
-v
Specifies verbose mode.
-p
Prints the header only.
-f filename
Specifies the output file name.
-y path
Sets the symbol search path.
You need to specify the dump file path (using the -f option) only if you have moved the dump file.
You need to specify the symbol search path (using the -y option) only if you are using an alternate symbol path. The symbol path for DUMPEXAM can contain several directories, separated by semicolons(;). These directories are searched in the order in which they are listed, so you should list directories with the most recently installed hotfixes or service packs first.
In our first example, the memory dump was created on a computer with Windows NT Workstation 3.51 and no service packs. The symbols are all in the directory /SYMBOLS. The dump file is in the directory /DUMP and is called MACHINE1.DMP. The command line reads as follows:
dumpexam -y /symbols /dump\machine1.dmp
The results of the exam will be in \systemroot\MEMORY.TXT.
In the next example, the memory dump was created on a DEC Alpha computer running Windows NT Server 3.5, with Service Pack 2 installed. The Service Pack 2 symbols are in D:\SP2\SYMBOLS. The Windows NT Server 3.5 symbols are on the product CD, which is in the E drive. The dump file MEMORY.DMP, is in D:\TEMP. The output file is to be put in the same directory as the dump file. The command line reads as follows:
dumpexam -y d:\sp2\symbols;e:\support\debug\alpha -f d:\temp\memory.txt d:\temp\memory.dmp