ADM390 Microsoft Windows Crash Dump Analysis.ppt

ADM390Microsoft? Windows? Crash Dump Analysis Mark RussinovichWinternals Software About The Speakers Authors of: Inside Windows 2000, 3rd Edition(Microsoft Press) Inside Windows 2000/XP/2003 Interactive Internals Video Tutorial Used by Microsoft for worldwide internal training David Solomon: Teaches Windows internals classes () Writes books and articles on Windows internals Mark Russinovich: Author of tools on Co-founder and Chief Software Architect for Winternals Software () Teaches Windows internals classes Writes books and articles on Windows internals Outline What causes crashes? Crash dump options Analysis with WinDbg/Kd Debugging hung systems Microsoft On-line Crash Analysis Using Driver Verifier Live kernel debugging Getting past a crash Introduction Many systems administrators ignore Windows NT/Windows 2000’s crash dump options “I don’t know what to do with one” “Its too hard” “It won’t tell me anything anyway” Basic crash dump analysis is actually pretty straightforward Even if only 1 out of 5 or 10 dumps tells you what’s wrong, isn’t it worth spending a few minutes? Why Analyze Dumps? The debuggers and Microsoft Online Crash Analysis (OCA) often solve crashes Sometimes, however, they do not, so your analysis might tell you: What driver to disable, update, or replace with different hardware What OEM to send the dump to What Causes Crashes? System crashes when a fatal error prevents further execution Any kernel-mode component can crash the system Drivers and the OS share the same memory space Therefore, any driver or OS component can, due to a bug, corrupt system memory Note: This is for performance reasons and is the same on Linux, most Unix’s, VMS, etc… What Are The Root Causes? Anecdotal evidence suggests: Buggy drivers Bugs in the OS Hardware failure/error Cosmic rays At The Crash A component calls KeBugCheckEx, which takes five arguments: Stop code 4 stop-code defined parameters KeBugCheckEx: Turns off interrupts Tells other CPUs to stop Paints t