FAQ

How to check if Windows dump file is corrupted or not?

FAQ ID:    FAQ851
Version:    1.0
Status:    Published
Published date:    06/10/2010
 

Answer

Since the size of "Complete Memory Dump" is sometimes huge (which could be same size as the size of your PC physical memory), BlueCoat support often receive corrupted file from our customer.

Microsoft provide the file checking tool. Please check if the file is corrupted or not by "dumpcheck.exe" in advance of uploading it to BlueCoat support.

 Tool explanation : http://support.microsoft.com/kb/315271

 Download the tool: ftp://ftp.bluecoat.com/get/dumpchk.zip

 

===================================

 Sample output for clean dump file

===================================

C:\>dumpchk.exe OK_MEMORY.DMP

Loading dump file OK_MEMORY.DMP

----- 32 bit Kernel Summary Dump Analysis

 

DUMP_HEADER32:

MajorVersion        0000000f

MinorVersion        00000a28

DirectoryTableBase  00723000

PfnDataBase         81086000

PsLoadedModuleList  8055f720

PsActiveProcessHead 805658b8

MachineImageType    0000014c

NumberProcessors    00000002

BugCheckCode        000000e2

BugCheckParameter1  00000000

BugCheckParameter2  00000000

BugCheckParameter3  00000000

BugCheckParameter4  00000000

PaeEnabled          00000001

KdDebuggerDataBlock 8054f2e0

 

SUMMARY_DUMP32:

DumpOptions         504d4453

HeaderSize          00019000

BitmapSize          000bdc00

Pages               0000c58d

Bitmap.SizeOfBitMap 000bdc00

 

KiProcessorBlock at 8055e5a0

  2 KiProcessorBlock entries:

  ffdff120 ba340120

 

 

Windows XP Kernel Version 2600 (Service Pack 3) MP (2 procs) Free x86 compatible

Built by: 2600.xpsp_sp3_gdr.080814-1236

Kernel base = 0x804d9000 PsLoadedModuleList = 0x8055f720

Debug session time: Thu Mar 11 14:22:18 2010

System Uptime: 0 days 1:53:13

start    end        module name

804d9000 806e6000   nt             Checksum: 001F41E9  Timestamp: Thu Aug 14 18:33:13 2008 (48A3FBD9)

 

Unloaded modules:

b702f000 b7037000   usbccgp.sys    Timestamp: Thu Mar 11 14:17:08 2010 (4B987CD4)

a5190000 a5194000   kbdhid.sys    Timestamp: Thu Mar 11 14:17:08 2010 (4B987CD4)

97d80000 97dab000   kmixer.sys    Timestamp: Thu Mar 11 13:38:46 2010 (4B9873D6)

97d80000 97dab000   kmixer.sys    Timestamp: Thu Mar 11 13:29:31 2010 (4B9871AB)

97d80000 97dab000   kmixer.sys    Timestamp: Thu Mar 11 13:00:01 2010 (4B986AC1)

97eeb000 97f16000   kmixer.sys    Timestamp: Thu Mar 11 12:42:55 2010 (4B9866BF)

9931e000 99349000   kmixer.sys    Timestamp: Thu Mar 11 12:35:10 2010 (4B9864EE)

9a8b9000 9a8e4000   kmixer.sys    Timestamp: Thu Mar 11 12:32:40 2010 (4B986458)

ba6f7000 ba6f8000   drmkaud.sys    Timestamp: Thu Mar 11 12:32:35 2010 (4B986453)

9ac8a000 9ac97000   DMusic.sys    Timestamp: Thu Mar 11 12:32:35 2010 (4B986453)

9ac9a000 9aca8000   swmidi.sys    Timestamp: Thu Mar 11 12:32:35 2010 (4B986453)

9a922000 9a945000   aec.sys     Timestamp: Thu Mar 11 12:32:35 2010 (4B986453)

ba5d0000 ba5d2000   splitter.sys    Timestamp: Thu Mar 11 12:32:35 2010 (4B986453)

ba5ca000 ba5cc000   WAM.sys     Timestamp: Thu Mar 11 12:32:20 2010 (4B986444)

9ba25000 9ba39000   naveng.sys    Timestamp: Thu Mar 11 12:31:40 2010 (4B98641C)

9ba39000 9bb7b000   navex15.sys    Timestamp: Thu Mar 11 12:31:40 2010 (4B98641C)

a64e9000 a64ee000   Cdaudio.SYS    Timestamp: Thu Mar 11 12:29:36 2010 (4B9863A0)

a1505000 a1508000   Sfloppy.SYS    Timestamp: Thu Mar 11 12:29:27 2010 (4B986397)

9f342000 9f347000   Flpydisk.SYS    Timestamp: Thu Mar 11 12:29:27 2010 (4B986397)

9f34a000 9f351000   Fdc.SYS     Timestamp: Thu Mar 11 12:29:27 2010 (4B986397)

 

Finished dump check

 

===================================

 Sample output for corrupted dump file

===================================

C:\>dumpchk.exe NG_MEMORY.DMP

Loading dump file NG_MEMORY.DMP

----- 32 bit Kernel Full Dump Analysis

 

DUMP_HEADER32:

MajorVersion        0000000f

MinorVersion        00000a28

DirectoryTableBase  0afc0020

PfnDataBase         81a00000

PsLoadedModuleList  8055d720

PsActiveProcessHead 805638b8

MachineImageType    0000014c

NumberProcessors    00000002

BugCheckCode        000000c9

BugCheckParameter1  00000224

BugCheckParameter2  a6ab17d2

BugCheckParameter3  00000000

BugCheckParameter4  00000000

PaeEnabled          00000001

KdDebuggerDataBlock 8054d2e0

 

Physical Memory Description:

Number of runs: 6

          FileOffset  Start Address  Length

           00001000     00001000     00096000

           00097000     00100000     00eff000

           00f96000     01000000     7b6a1000

           7c637000     7c6a7000     00110000

           7c747000     7c80f000     000b8000

           7c7ff000     7cbff000     00001000

Last Page: 7c7ff000     7cbff000

 

KiProcessorBlock at 00000000

  2 KiProcessorBlock entries:

  00000000 00000000

 

Windows XP Kernel Version 2600 MP (2 procs) Free x86 compatible

Kernel base = 0x00000000 PsLoadedModuleList = 0x8055d720

Debug session time: Fri Feb 05 17:00:41 2010

System Uptime: 1 days 19:45:51

***** NT module not found - module list may be corrupt  <<====== File corrupted message !!

Finished dump check

 


Rate this Page

Please take a moment to complete this form to help us better serve you.

Did this document help answer your question?
 
 
If you are finished providing feedback, please click the RATE CONTENT button. Otherwise, please add more detail in the following text box and then click RATE CONTENT.
 
 

Your response will be used to improve our document content.

Ask a Question