How to Analyze a BSOD Crash Dump

Blue screens of death can be caused by a multitude of factors. There are many tools on the internet that can analyze these; however, Microsoft has its own tool. When a computer is exhibiting problems, most users are reluctant to download a 3rd party tool that "might make things worse." This is where the Windows Debugging Tools come into play.

23-12-31Update!

Microsoft has made the tool available for download without having to install it as part of a package. WooHoo! This package, according to their documentation, only works with Windows 10/11. I am currently running Linux, so I cant test it. ( side note: If you want to try Linux, id highly recommend this https://fedoraproject.org/spins/kde/ It's a Fedora spin called Plasma. Its a lot like Windows, but its ultra stable and secure out of the box, let me know if you're interested or need help.) I might make a tutorial; however, we are talking about Windows now, here's the link: https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/ Download the tool and continue from Step 4.

This How to Will Instruct a User on How to Install the Tool and How to Analyze a Crash Dump to Determine the Cause.

• Windows 7 and Newer: Navigate to the Windows Dev Center to download the Windows Software Development Kit downloader. This is not the tool, its only the downloader for the tool.
• Windows Vista and XP: Download the Microsoft Windows SDK for Windows 7 and .NET Framework 4 as .NET Framework 4.5 is not supported on Windows XP.

1. Click Next through the installer until you reach the screen that downloads the packages, labeled: "Select the features you want to install."
2. Deselect all the checkboxes next to all the packages except Debugging tools for Windows
3. Click Install.

1. Run Windbg as administrator. The screenshot is from Windows 8.1, but this step is the same for all Operating systems Vista and higher, run as Administrator.
   
   1. On Windows 8.1, this is achieved by searching for the program, then Right Clicking it in the list to the right.
   2. It is important that Windbg be ran as Administrator.
      1. On Windows 8 and higher machines, there are permission issues reading crash dumps when the user isn't elevated.

1. Click on File
2. Click on Symbol File Path ...

1. Paste the following text into the Symbol Search Path Dialog
   1. SRV*C:\Windows\symbol_cache*http://msdl.microsoft.com/download/symbols
2. Click OK

1. Click on File
2. Click on Save Workspace

1. Click on File
2. Click on Open Crash Dump...
3. Navigate to: C:\Windows\
4. Select the file named MEMORY.DMP
5. Click Open

1. At the bottom of the wall of text, you will notice a line with the text:
   1. Probably caused by :
      1. If you can imagine, thats what caused the BSOD.
      2. Google the thing that caused your bsod
         1. For example: In this instance i would google
            1. BSOD Win8.1 NETIO.SYS

1. Click on the blue link named !analyze -v
2. This will give a further detailed analysis to post on a forum, or send to someone else.
3. It will also tell you what kind of fault it was, in this instance, my bsod was a
   1. DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT

1. Click on Edit
2. Click on Write Window Text to File...
3. Choose a location that is easy to remember, such as Documents.
4. Share the text file with people that can help!
5. Done!