Windows 10: Debugging Tools for Windows 10 Question

Shouldn't Windbg work with any dump file, even if its for 10? OR is this Windbg only going to work with 10. What am I doing wrong?

(BTW, this is a dump from a Windows 7 machine I'm trying to open)

I get this error:

:)

 

I can not find any debugging tool?

I have installed visual studio 2015 which comes with windows sdk for windows 10, and according to this page: Debugging Tools for Windows (WinDbg, KD, CDB, NTSD)

windows debugging tool comes with sdk.

Also according to this page:

Tools Included in Debugging Tools for Windows

debugging tools located in C:\Program Files (x86)\Windows Kits\10\Debuggers\, however, when I go to that directory, I can not find any debugging tools.

Who knows what happened?

 

Using Windows Debugging tool

When you do !thread then DPs and it says module loaded but symbols could not be simply means there may be a missing or corrupt symbol. If on the other hand it says module could not be loaded it is much more indicative.

So a mention is less reliable than an actual indicator of hardware.

Symbols are technically not necessary to analysis. If one knows enough assembly and all that jazz to figure things out on their own, they can disassemble the code and backtrack through it all and get a mental idea what was taking place. Escalation engineers
like those in Microsoft are known to doing just that with 3rd-party drivers they don't have access to public symbols for. Despite having no symbols,

From a thread about them on sysnative by Vir Garnus.

The Raw Truth - Using Raw Stacks

 

Yes it should work.

First try this link: https://www.osronline.com/page.cfm?name=analyze
This'll let you upload and perform a quck analysis on a memory dump file - which will tell you if the memory dump is corrupt or not.

Then, if it isn't corrupt, the next step would be to uninstall the Debugging Tools and then install a freshly downloaded copy (in case of corruption).

BUT, from looking closer at the error message, it appears that you're trying to run the dump file out of a ZIP archive. That's not supported in WinDbg. Extract the .dmp file to your Desktop and try to run it from there.

Also, try opening up WinDbg and using the File menu to open up the extracted memory dump (the one inside the ZIP archive shouldn't open there either).

Finally (this is sorta bass-ackwards on my part), is the question - What version of Debugging Tools are you using?
Is it the newly released version for Win10? Please remember that that version is still "beta" software.

Good luck!

 

Thanks John, yes its the newly released 10.0 something WinDbg. I downloaded it with Windows SDK. When I was on my 8.1 machine they would always open the same way I am trying now so I'll have to see how I have it setup. Seems as though I've always clicked the link on the thread and opened the first dump and it always worked.

Thanks for the link and info, I'll have a look at it now.

 

Tried to extract to a folder in my documents and into documents itself, I got this error.

Update: I tried opening it up manually and it works. Wonder why it won't work from simply opening the file as opposed to navigating to the file from within WinDBG?

 

I always open dumps from a zipped archive, just easier that way for me. I've never had problems doing that.

 

I thought this were the case but I usually default to Johns wisdom.

 

I'm not questioning his wisdom, just stating what I do.

 

Oh I didn't mean he is right. I was just saying I thought I always did it out of a zipped archive as well but since he said it was not supported I just figured maybe I was mistaken. I also manually opened it out of a zipped folder which worked.

 

It may not be supported like he says, but it does work. I never extract the zip archive, I just work out of it and then only have one item to delete.

Anyway, back to your original problem now, I didn't intend to derail the thread.

 

Its no problem at all Derek. Your input is always welcome.

As for the problem, I think it was because I didn't set up ALL of the associations. I only had dmp files. I set all file associations like you're supposed to and viola.. It works.

Thanks to both for the suggestions.

 

Cool, glad you got it sorted!

 

I have never been able to open a .dmp out of a zip archive - nor have I spent any significant time trying to figure this out..
Nor have I ever setup my system to open .dmp files with WinDbg or kd.exe Inor have I setup the file association for .dmp).
I am unable to drag/drop a .dmp from a zip archive into WinDbg - and never have been able to do so as long as explorer.exe has supported opening zip archives

My workaround is to drag the .dmp files out of the zip archive and into my BSOD analysis directory - and then run kd.exe/WinDbg from there..

This behavior didn't change when I upgraded to the new Win10 tools. But, I have to wonder if the tight integration of WinDbg with Visual Studio may have affected the way that the debugger is setup on your system.

FYI - I am not a WinDbg expert. I use a relatively few commands to extract info from the dump files. Those that are more familiar with the debugger will generally request full/kernel dumps. I don't do that because the amount of work/time spent on coaxing info out of full/kernel dumps isn't very productive and (IME) rarely results in helping users. The extra commands/functions are very useful for driver developers - but users generally can't fix the things that driver developers are looking for.

 

John, does this method not work using 7Zip?

Attachment 16825