You are currently offline, waiting for your internet to reconnect

How to Use Dumpchk.exe to check a memory dump file

Support for Windows Server 2003 ended on July 14, 2015

Microsoft ended support for Windows Server 2003 on July 14, 2015. This change has affected your software updates and security options. Learn what this means for you and how to stay protected.

This article was previously published under Q156280
For a Microsoft Windows XP version of this article, see 315271.
SUMMARY
Dumpchk is a command-line utility you can use to verify that a memory dumpfile has been created correctly. Dumpchk does not require access tosymbols.

You can download debugging tools for Windows products from the following Microsoft Web site:Dumpchk is located in the following locations:
  • Windows NT 4.0 CD-ROM:
    Support\Debug\<Platform>\Dumpchk.exe
  • Windows 2000 CD-ROM: Install the Support Tools by running Setup.exe from the Support\Tools folder on the CD-ROM. By default, Dumpchk.exe is installed to the Program Files\Support Tools folder.
MORE INFORMATION
Dumpchk has the following command-line switches:
   DUMPCHK [options] <CrashDumpFile>     -? Display the command syntax.     -p Prints the header only (with no validation).     -v Specifies verbose mode.     -q Performs a quick test. Not available in the Windows 2000.				
Additional switches that are only available in Windows 2000 Dumpchk.exe version:
    -c Do dump validation.    -x Extra file validation. Takes several minutes.    -e Do dump exam.    -y <Path> Set the symbol search path for dump exam.        If the symbol search path is empty, the CD-ROM       is used for symbols.    -b <Path> Set the image search path for dump exam.       If the symbol search path is empty, <SystemRoot>\system32       is used for symbols.    -k <File> Set the name of the kernel to File.    -h <File> Set the name of the hal to File.				
Dumpchk displays some basic information from the memory dump file, thenverifies all the virtual and physical addresses in the file. If any errorsare found in the memory dump file, Dumpchk reports them. The following isan example of the output of a Dumpchk command:
   Filename . . . . . . .memory.dmp   Signature. . . . . . .PAGE   ValidDump. . . . . . .DUMP   MajorVersion . . . . .free system   MinorVersion . . . . .1057   DirectoryTableBase . .0x00030000   PfnDataBase. . . . . .0xffbae000   PsLoadedModuleList . .0x801463d0   PsActiveProcessHead. .0x801462c8   MachineImageType . . .i386   NumberProcessors . . .1   BugCheckCode . . . . .0xc000021a   BugCheckParameter1 . .0xe131d948   BugCheckParameter2 . .0x00000000   BugCheckParameter3 . .0x00000000   BugCheckParameter4 . .0x00000000   ExceptionCode. . . . .0x80000003   ExceptionFlags . . . .0x00000001   ExceptionAddress . . .0x80146e1c   NumberOfRuns . . . . .0x3   NumberOfPages. . . . .0x1f5e   Run #1     BasePage . . . . . .0x1     PageCount. . . . . .0x9e   Run #2     BasePage . . . . . .0x100     PageCount. . . . . .0xec0   Run #3     BasePage . . . . . .0x1000     PageCount. . . . . .0x1000   **************   **************--> Validating the integrity of the PsLoadedModuleList   **************   **************   **************--> Performing a complete check (^C to end)   **************   **************   **************--> Validating all physical addresses   **************   **************   **************--> Validating all virtual addresses   **************   **************   **************--> This dump file is good!   **************				
If there is an error during any portion of the output displayed above,the dump file is corrupted and analysis cannot be performed.

In this example, the most important information (from a debuggingstandpoint) is the following:
   MajorVersion . . . . .free system   MinorVersion . . . . .1057   MachineImageType . . .i386   NumberProcessors . . .1   BugCheckCode . . . . .0xc000021a   BugCheckParameter1 . .0xe131d948   BugCheckParameter2 . .0x00000000   BugCheckParameter3 . .0x00000000   BugCheckParameter4 . .0x00000000				
This information can be used to determine what Kernel STOP Error occurredand, to a certain extent, what version of Windows was in use.

The information in this article is from the Windows NT Resource Kit. Formore information on Dumpchk.exe and other debugging utilities, see AppendixA in the Windows NT 3.51 Resource Kit Update and Update 2.

For additional information, click the following article number to view the article in the Microsoft Knowledge Base:
119490 Checking the Crashdump file for corruption
prodnt
Properties

Article ID: 156280 - Last Review: 03/07/2009 00:34:24 - Revision: 6.1

Microsoft Windows Server 2003, Standard Edition (32-bit x86), Microsoft Windows Server 2003, Enterprise Edition (32-bit x86), Microsoft Windows Server 2003, Datacenter Edition (32-bit x86), Microsoft Windows Server 2003, Enterprise x64 Edition, Microsoft Windows Server 2003, 64-Bit Datacenter Edition, Microsoft Windows 2000 Server, Microsoft Windows 2000 Advanced Server, Microsoft Windows 2000 Professional Edition, Microsoft Windows 2000 Datacenter Server, Microsoft Windows NT Workstation 3.5, Microsoft Windows NT Workstation 3.51, Microsoft Windows NT Workstation 4.0 Developer Edition, Microsoft Windows NT Server 3.5, Microsoft Windows NT Server 3.51, Microsoft Windows NT Server 4.0 Standard Edition, Windows Server 2008 Standard, Windows Server 2008 Standard without Hyper-V, Windows Server 2008 Enterprise, Windows Server 2008 Enterprise without Hyper-V, Windows Server 2008 Datacenter, Windows Server 2008 Datacenter without Hyper-V, Windows Server 2008 for Itanium-Based Systems, Windows Web Server 2008, Windows Server 2008 R2 Standard, Windows Server 2008 R2 Enterprise, Windows Server 2008 R2 Datacenter, Windows Web Server 2008 R2

  • kbnetwork KB156280
Feedback
I=4050&did=1&t="> 日本 - 日本語
Eesti - Eesti
Norge - Bokmål
United States (English)
香港特別行政區 - 繁體中文
El Salvador - Español
Panamá - Español
Uruguay - Español
대한민국 - 한국어
España - Español
Paraguay - Español
Venezuela - Español
/html>microsoft.com/c.gif?DI=4050&did=1&t="> var varCustomerTracking = 1; var Route = "76500"; var Ctrl = ""; document.write(" .getElementsByTagName('head')[0].appendChild(m);" onload="var m=document.createElement('meta');m.name='ms.dqp0';m.content='false';document.getElementsByTagName('head')[0].appendChild(m);" src="http://c1.microsoft.com/c.gif?">