How to Debug with a User Mode Crash Dump

ID: Q162699

The information in this article applies to:
  • Microsoft Windows NT Workstation versions 3.51, 4.0
  • Microsoft Windows NT Server versions 3.51, 4.0
  • Microsoft Windows 2000
IMPORTANT: This article contains information about editing the registry. Before you edit the registry, make sure you understand how to restore it if a problem occurs. For information about how to do this, view the "Restoring the Registry" Help topic in Regedit.exe or the "Restoring a Registry Key" Help topic in Regedt.32.exe.

SUMMARY

One of the new features introduced in Windows NT 3.51 was the ability for the operating system to write a user mode crashdump of a user mode process that crashed. This article details how to configure Windows NT to write this file and how to begin analyzing this file.


MORE INFORMATION

Configuring Windows NT to Write a User Mode Crashdump

  1. To enable the system exception handler to write a user mode dump, run drwtsn32 from a command prompt.


  2. Under Options, check Create Crash Dump File and Dump All Thread Contexts.

    Note: It is not recommended to check 'Dump Symbol Table' unless necessary.

    If symbol information is needed, the symbol files (available on the Windows NT CD-ROM under Support\Debug\I386\Symbols) should be copied to %SystemRoot%\Symbols.


Loading a User Mode Crash Dump Into Windbg

  1. Start Windbg from the command prompt or an icon. Go to Program Open New. Browse to the User.dmp file (in %SystemRoot% by default) and click OK twice.


  2. From the Options menu, click Symbols, and then click Load a Symbol file, regardless of any errors.


  3. From the Options menu, click Symbols... Fill in the Debug Symbol Search Path.

    NOTE: You can use multiple paths separated by semicolon. Also, you can select Load under the Symbols section and then hit Default under the Default section. This will force the symbols to be validated.


  4. Click OK.


  5. Finally, from the Run menu, click Restart to begin processing the dump file.


Basic Commands

Look at the current stack trace (k, kv, or kb) and debug much like you would debug a kernel mode crash dump. The ~ key will give the active threads~2 will switch to the 2nd thread Lm (load modules) is similar to !drivers. Several of the kernel mode commands and extensions work on the user mode debugger side, type in help for a complete list of commands.

Miscellaneous

If the user dump does not load properly, delete the following key in the registry and re-run windbg:

WARNING: Using Registry Editor incorrectly can cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that problems resulting from the incorrect use of Registry Editor can be solved. Use Registry Editor at your own risk.

For information about how to edit the registry, view the "Changing Keys And Values" Help topic in Registry Editor (Regedit.exe) or the "Add and Delete Information in the Registry" and "Edit Registry Data" Help topics in Regedt32.exe. Note that you should back up the registry before you edit it.
  1. Run Registry Editor (Regedt32.exe)


  2. Delete the
    HKEY_CURRENT_USER\Software\Microsoft\windbg key.


  3. Restart your computer.


If this doesn't help, then the User.dmp is likely corrupt, possibly not correctly written at the time of exception.

The Drwtsn32.log file located in %SystemRoot% can be very helpful also. This log file corresponds to the User.dmp. It displays all threads in detail for the process in which the exception occurred. To find the thread that failed, search for FAULT. Also, the thread IDs in the Drwtsn32.log can be correlated to the thread IDs in the User.dmp by counting the threads from the top of the log starting with 0.

For additional information, please see the following article in the Microsoft Knowledge Base:
ARTICLE-ID: Q158715
TITLE : User Mode Dump Files Must be Debugged on Same Architecture

For more information on Windows NT debugging, query on the following word here in the Microsoft Knowledge Base:
debugref

Additional query words: prodnt debug

Keywords : kbnetwork kbNTOS351 kbNTOS400 kbWinOS2000 NTSrvWkst
Version : WINDOWS:; winnt:3.51,4.0
Platform : WINDOWS winnt
Issue type : kbhowto


Last Reviewed: January 12, 2000
© 2000 Microsoft Corporation. All rights reserved. Terms of Use.