Notes WinDBG

This article shows how to GET and INSTALL and use WINDBG.

Goal: To analyse *.dmp file from Blue Screen of Death (BSOD)

OS: Windows 7 SP1 or Windows Server 2008 R2

Ref: http://windows7themes.net/how-to-open-dmp-files-in-windows-7.html


1. To get the WinDBG.exe, go to:
http://www.microsoft.com/en-us/download/details.aspx?displaylang=en&id=8279
This is the site called Microsoft Windows SDK for Windows 7 and .NET Framework 4

Discovering this site was a challenge. I first type "windbg" on Google. Then the usual Microsoft run around actually pointed to the Windows 8 RC version for this tool. But the link above is the correct one for Win7 and Win 2008 ServerR2.

Although we need WinDBG only, it comes as part of the Windows Driver Kit or the SDK as well.
The site above lets you download "winsdk_web.exe" 498K. This is a web setup - which is why the size is so small.



2. Install WinDBG.
Click on winsdk_web.exe
You may get an error if you choose to install everything.
I needed WinDBG only so I selected the following to install:
- .Net Development
    Intellisense and Reference Assemblies
    Tools
- Common Utilities
    (ALL)
- Redistributatble Packages
    Debugging Tools

3. Run WinDBG.exe
When installed properly, it is generally located in:
C:\Program Files\Microsoft SDKs\Windows\v7.1\Redist\Debugging Tools for Windows
.... or something like that.

From the Start Menu, type WinDBG on the search bar.

Or from the Start Menu - All Programs - Debugging Tools for Windows - WinDBG


4. Get Debugging Symbols
This is a one time setup.
- Create a new folder called C:\Symbols
- Open WinDBG
- Click on File – Symbol File Path
- Insert the following path:
SRV*C:\Symbols*http://msdl.microsoft.com/download/symbols


5. Analyse DMP files.
Usually BSOD dump files are located in: C:\Windows\Minidump....
In WinDBG, click File - Open Crash Dump, then select your dump file.

Some information is displayed on the Window. If you need more information, click on the text called "!analyze -v" in the WinDBG window.

Tools for Windows

Below is a list of Windows tools. Please let me know if you find other useful ones.

Also here are some sites which feature collection of useful software:
100 Portable Apps for your USB Stick (for Mac and Win)
PortableApps.com - features a collection of program fitted onto a USB stick.
ROEMware - a categorized minimalist set of applications for OEM builders.

System / Memory Scanner - online tool. This is not restricted to Windows. Just go to the website and it will scan your memory configuration and system statistics.

Process Explorer - "Task Manager on steroids". It can replace Task Manager or run side by side with it, but either way it's an absolute must-have for technically savvy users. When you launch Process Explorer, you'll see a tree view of processes; they're nominally organized by which process spawned which, but you can click on the column headers to change the sorting as you please. The top portion of the window has four graphs: CPU usage, commit history, I/O bytes history, and physical memory history. Click on one to bring up a full-sized window view that's akin to the Performance tab in Task Manager -- but with a level of detail and insight into what programs are doing that Task Manager doesn't even come close to providing.

System Information for Windows - lists application license keys, probes installed hardware, fetches device temperatures, catalogs installed multimedia codecs -- the list seems endless.

BlueScreenView - When a BSOD occurs the results are, whenever possible, saved into a dump file that can be examined later. BlueScreenView scans your system for these files and produces a report from them, which you can read within BlueScreenView itself or save to HTML for separate analysis. Each line in the report describes the BSOD's crash code, the time and date of its occurrence, any parameters that might have been passed with the crash (useful for debugging), and a slew of other minor details. The results are searchable, so you can hunt for a particular crash code, driver, or DLL that you think might be present.

Autoruns -- probes your system and dumps out lists of programs and system components that start automatically, without user intervention -- from apps in your Startup folder to scheduled tasks, from services to device drivers, from Sidebar gadgets to codecs. By default it dumps out data pertinent to the current user context, but the program's User menu lets you switch contexts. (You'll need to run the program as Administrator, though.)

 WinDirStat - generates easy-to-understand graphical reports about disk usage, allowing you to see at a glance which individual files or folders hidden deep within a directory tree may be gobbling up dozens of gigabytes.




 Unlocker, Determine which process has a lock on which file, and let you release it either by killing the file handle or the offending process.

OpenedFilesView Determine which process has a lock on which file, and let you release it either by killing the file handle or the offending process.