如果您的 PC 最近崩溃了，您一定遇到过蓝屏死机^{(Blue Screen)}(^(Death) BSOD )^(BSOD)，其中列出了崩溃的原因，然后PC^{(PC shutdown)}突然关闭。现在BSOD 画面^{(BSOD screen)}只显示几秒钟，目前无法分析崩溃的原因。值得庆幸的是，当Windows崩溃时，会创建一个崩溃转储文件^{(dump file)}( .dmp ) 或内存转储，以在^{(memory dump)}Windows 关闭^{(Windows shutdown)}之前保存有关崩溃的信息。

一旦显示BSOD 屏幕^{(BSOD screen)}，Windows就会将有关崩溃的信息从内存中转储到一个名为“MiniDump”的小文件中，该文件通常保存在Windows 文件夹^{(Windows folder)}中。而这个 .dmp 文件可以帮助您排查错误原因，但您需要分析转储文件^{(dump file)}。这是它变得棘手的地方，Windows不使用任何预安装的工具来分析这个内存转储文件^{(memory dump file)}。

现在有各种工具可以帮助您调试.dmp 文件^{(.dmp file)}，但我们将讨论两个工具，即BlueScreenView 和 Windows Debugger 工具^{(BlueScreenView and Windows Debugger tools)}。BlueScreenView可以快速分析 PC出了什么问题，并且可以使用Windows 调试器工具获取更高级的信息。^{(Windows Debugger tool)}因此，不要浪费任何时间，让我们^{(time let)}在下面列出的指南的帮助下了解如何在Windows 10中读取^{(Windows 10)}内存转储文件。^{(Memory Dump Files)}

如何在Windows 10中读取^{(Windows 10)}内存转储文件^{(Memory Dump Files)}

确保^(Make)创建一个还原点^{(restore point)}，以防万一^{(case something)}出现问题。

方法一：使用 BlueScreenView 分析内存转储文件^{(Method 1: Analyze Memory Dump Files using BlueScreenView)}

1.根据您的Windows版本，从^(Windows)NirSoft 网站下载最新版本的 BlueScreenView^{( NirSoft Website downloads the latest version of BlueScreenView)}。

2. 解压您下载的zip 文件^{(zip file)}，然后双击BlueScreenView.exe运行该应用程序。

3. 程序会自动在默认位置^{(default location)}C C:\Windows\Minidump.搜索MiniDump文件。

4. 现在，如果您想分析特定的.dmp 文件，将该文件^{( .dmp file,)} 拖放^{(drag and drop)}到BlueScreenView 应用程序^{(BlueScreenView application)}，程序将轻松读取minidump 文件^{(minidump file)}。

5. 您将在BlueScreenView^{(BlueScreenView)}顶部看到以下信息：

• Minidump 文件^{(Minidump file)}的名称：082516-12750-01.dmp。这里 08 是月份，25 是日期，16 是转储文件^{(dump file)}的年份。
• 崩溃时间^(Time)是崩溃发生的时间：26-08-2016 02:40:03
• 错误检查字符串^{(Bug Check String)}是错误代码^{(error code)}：DRIVER_VERIFIER_IOMANAGER_VIOLATION
• 错误检查代码^{(Bug Check Code)}是STOP 错误^{(STOP error)}：0x000000c9
• 然后会有Bug Check Code Parameters
• 最重要的部分是由驱动^(Driver)程序引起的：VerifierExt.sys

6. 屏幕下方会突出显示导致错误的驱动程序。^{(the driver who caused the error will be highlighted.)}

7. 现在您有了关于错误的所有信息，您可以轻松地在网上搜索以下内容：

Bug Check String +由驱动程序^(Driver)引起，例如DRIVER_VERIFIER_IOMANAGER_VIOLATION VerifierExt.sys
Bug Check String + Bug Check Code eg：DRIVER_VERIFIER_IOMANAGER_VIOLATION 0x000000c9

8. 或者你也可以在BlueScreenView^{(BlueScreenView and click “)}里面的minidump文件上右击，然后点击^{(minidump file)}Google Search – Bug Check + Driver。

9. 使用此信息排除故障原因并修复错误。这就是如何使用 BlueScreenView 在 Windows 10 中读取内存转储文件指南的结尾。^{(How to Read Memory Dump Files in Windows 10 using BlueScreenView.)}

方法 2：使用 Windows 调试器分析内存转储文件^{(Method 2: Analyze Memory Dump Files Using Windows Debugger)}

1.从这里下载 Windows 10 SDK^{(Download Windows 10 SDK from here)}。

注意：^(Note:)该程序包含我们将用来分析 .dmp 文件的WinDBG 程序。^{(WinDBG program)}

2. 运行sdksetup.exe文件并指定安装位置或使用默认^{(installation location or use default)}。

3.接受许可协议^{(Accept License agreement)}，然后在“选择要安装的功能”^{(Select the features you want to install)}屏幕上仅选择“Windows 调试工具”选项^{(select only the Debugging Tools for Windows option)}，然后单击“安装”。

4. 应用程序将开始下载WinDBG 程序^{(WinDBG program)}，因此请等待它安装在您的系统上。

5. 打开命令提示符^{(Command Prompt)}。用户可以通过搜索“ cmd”然后按 Enter 来执行此步骤。

6. 在 cmd 中输入以下命令并按Enter：

cd\Program Files (x86)\Windows Kits\10\Debuggers\x64\

注意：指定^(Note:)WinDBG 程序^{(WinDBG program)}的正确安装。

7. 现在，一旦您进入正确的目录，输入以下命令将WinDBG与 .dmp 文件关联：

windbg.exe -IA

8. 输入上述命令^{(above command)}后，将打开一个新的WinDBG空白实例，并显示确认通知^{(confirmation notice)}，您可以关闭该实例。

9. 在 Windows 搜索中键入windbg，然后单击WinDbg (X64)。

10. 在 WinDBG 面板中，单击文件，然后选择符号文件路径。^{(click on File, then select Symbol File Path.)}

11.将以下地址复制并粘贴^{(Copy and paste)}到符号搜索路径^{(Symbol Search Path)}框中：

SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols

12. 单击OK，然后单击File > Save Workspace.符号路径。^{(symbol path)}

13. 现在找到您要分析的转储文件，您可以使用^{(dump file)}C:\Windows\Minidump中的MiniDump 文件^{(MiniDump file)}或使用C:\Windows\MEMORY.DMP.内存转储^{(Memory dump)}文件。

14. 双击.dmp 文件^{(.dmp file)}，WinDBG应启动并开始处理该文件。

注意：^(Note:)由于这是在您的系统上读取的第一个.dmp 文件， ^{(.dmp file)}WinDBG看起来很慢，但不会中断进程，因为这些进程正在后台执行：

A folder called Symcache is being created in C:
Symbols are being downloaded and saved to C:\Symcache

下载符号并准备好分析转储后，您将在转储文本底部看到消息 Followup^{(message Followup)} : MachineOwner。^{(MachineOwner at the dump text’s bottom.)}

15. 此外，处理下一个.dmp 文件^{(.dmp file)}，它会更快，因为它已经下载了所需的符号。随着时间的推移，C:\Symcache folder的大小会随着添加更多符号而增大。

16. 按Ctrl + F打开 Find 然后输入“可能由”^{(Probably caused by)}（不带引号）并按Enter 键^(Enter)。这是找出导致崩溃的原因的最快方法。

17. 在可能^(Probably)由行上方，您会看到一个错误检查代码，例如 0x9F^{( BugCheck code, e.g., 0x9F)}。使用此代码并访问Microsoft 错误检查代码参考^{(Microsoft Bug Check Code Reference)(Microsoft Bug Check Code Reference)}以验证错误检查参考。

推荐的：^{(Recommended:)}

• 修复 Windows^{(Fix Windows)}无法在此计算机上设置家庭组
• 修复电脑屏幕随机关闭^{(Fix Computer Screen Turns Off Randomly)}
• 如何修复右键单击在^{(Right Click)}Windows 10中不起作用
• 修复注册表编辑器^{(Registry editor)}已停止工作

就是这样，您已经成功学习了如何在 Windows 10 中读取内存转储文件，^{(How to Read Memory Dump Files in Windows 10)}但如果您对这篇文章仍有任何疑问，请随时在评论部分询问。

How to Read Memory Dump Files in Windows 10

If your PC has recently crashed, you must haνe faсed the Blue Screen of Death (BSOD), which lists the crash’s cause and then the PC shutdown abruptly. Now the BSOD screen is onlу shown for a few seconds, and it’s not possіble to analyze the reаson for the crash at that moment. Thankfully, whеn Windows crashes, a crash dump file (.dmp) or memory dump іs сreated to save information about the crash just before the Windows shutdown.

As soon as the BSOD screen is displayed, Windows dumps the information about the crash from the memory to a small file called “MiniDump” which is generally saved in the Windows folder. And this .dmp files can help you troubleshoot the cause of the error, but you need to analyze the dump file. This is where it gets tricky, and Windows doesn’t use any pre-installed tool to analyze this memory dump file.

Now there is a various tool which can help you debug the .dmp file, but we are going to talk about two tools which are BlueScreenView and Windows Debugger tools. The BlueScreenView can analyze what went wrong with the PC quickly, and the Windows Debugger tool can be used to get more advanced information. So without wasting any time let’s see How to Read Memory Dump Files in Windows 10 with the help of the below-listed guide.

How to Read Memory Dump Files in Windows 10

Make sure to create a restore point just in case something goes wrong.

Method 1: Analyze Memory Dump Files using BlueScreenView

1. From NirSoft Website downloads the latest version of BlueScreenView according to your version of Windows.

2. Extract the zip file you download and then double-click on BlueScreenView.exe to run the application.

3. The program will automatically search for the MiniDump files at the default location, which is C:\Windows\Minidump.

4. Now if you want to analyze a particular .dmp file, drag and drop that file to BlueScreenView application and the program will easily read the minidump file.

5. You will see the following information at the top of the BlueScreenView:

• The name of the Minidump file: 082516-12750-01.dmp. Here 08 is the month, 25 is the date, and 16 is the year of the dump file.
• Crash Time is when the crash happens: 26-08-2016 02:40:03
• Bug Check String is the error code: DRIVER_VERIFIER_IOMANAGER_VIOLATION
• Bug Check Code is the STOP error: 0x000000c9
• Then there will be Bug Check Code Parameters
• The most important section is Caused By Driver: VerifierExt.sys

6. In the lower part of the screen, the driver who caused the error will be highlighted.

7. Now you have all the information about the error you could easily search the web for the following:

Bug Check String + Caused by Driver, e.g., DRIVER_VERIFIER_IOMANAGER_VIOLATION VerifierExt.sys
Bug Check String + Bug Check Code eg: DRIVER_VERIFIER_IOMANAGER_VIOLATION 0x000000c9

8. Or you can right-click on the minidump file inside the BlueScreenView and click “Google Search – Bug Check + Driver“.

9. Use this information to troubleshoot the cause and fix the error. And this is the end of the guide How to Read Memory Dump Files in Windows 10 using BlueScreenView.

Method 2: Analyze Memory Dump Files Using Windows Debugger

1. Download Windows 10 SDK from here.

Note: This program contains WinDBG program that we will be using to analyze the .dmp files.

2. Run the sdksetup.exe file and specify the installation location or use default.

3. Accept License agreement then at “Select the features you want to install” screen select only the Debugging Tools for Windows option and then click Install.

4. The application will begin downloading the WinDBG program, so wait for it to be installed on your system.

5. Open Command Prompt. The user can perform this step by searching for ‘cmd’ and then press Enter.

6. Type the following command into cmd and hit Enter:

cd\Program Files (x86)\Windows Kits\10\Debuggers\x64\

Note: Specify the correct installation of the WinDBG program.

7. Now once you’re inside the correct directory type the following command to associate WinDBG with .dmp files:

windbg.exe -IA

8. As soon as you enter the above command, a new blank instance of WinDBG will open with a confirmation notice which you can close.

9. Type windbg in Windows Search then click on WinDbg (X64).

10. In the WinDBG panel, click on File, then select Symbol File Path.

11. Copy and paste the following address into the Symbol Search Path box:

SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols

12. Click OK and then save the symbol path by clicking File > Save Workspace.

13. Now find the dump file you want to analyze, you could either use the MiniDump file found in C:\Windows\Minidump or use the Memory dump file found in C:\Windows\MEMORY.DMP.

14. Double click the .dmp file and the WinDBG should launch and begin processing the file.

Note: Since this is the first .dmp file being read on your system, WinDBG appears to be slow but do not interrupt the process as these processes are being carried out in the background:

A folder called Symcache is being created in C:
Symbols are being downloaded and saved to C:\Symcache

Once the symbols have been downloaded, and the dump is ready to analyze, you will see the message Followup: MachineOwner at the dump text’s bottom.

15. Also, the next .dmp file is processed, it will be quicker as it will have already downloaded the required symbols. Over time the C:\Symcache folder will grow in size as more symbols are added.

16. Press Ctrl + F to open Find then type “Probably caused by” (without quotes) and hit Enter. This is the quickest way to find what caused the crash.

17. Above the Probably caused by line, you will see a BugCheck code, e.g., 0x9F. Use this code and visit Microsoft Bug Check Code Reference for verifying the bug check refer.

Recommended:

• Fix Windows can’t set up a HomeGroup on this computer
• Fix Computer Screen Turns Off Randomly
• How To Fix Right Click Not Working in Windows 10
• Fix The Registry editor has stopped working

That’s it you have successfully learned How to Read Memory Dump Files in Windows 10 but if you still have any queries regarding this post then feel free to ask them in the comment’s section.

Related posts

• 如何在 Windows 10 中分析内存转储文件 (.dmp)

• 如何在Windows 10上运行JAR Files

• Windows 10中Fix Unable至Delete Temporary Files

• 如何在Windows 10上共享Setup Network Files

• 如何在Windows 10中Delete Win Setup Files [指南]

• Fix Computer Wo在Windows 10中没有转到Sleep Mode

• 如何在 Windows 10 中打开 JAR 文件

• Windows 10中的Decrypt EFS Encrypted Files and Folders

• 如何在 Windows 10 (2022) 中打开 RAR 文件

• 如何禁用Windows 10 Firewall

• Windows 10中的Fix Task Host Window Prevents Shut Down

• 在 Windows 10 中清除文件资源管理器最近的文件历史记录

• 在Crash Dump文件Windows 10物理Memory Limits

• 如何在 Windows 10 上打开 EMZ 文件

• 如何在Windows 10中更改Screen Brightness

• 如何在Windows 10到Repair Corrupted System Files

• 禁用Windows 10中的夹夹Zoom Feature

• Windows 10采用Encrypting File System（EFS）Encrypt Files and Folders

• 如何在Windows 10中启用或Disable Emoji Panel

• 如何在Windows 10中使用Fn Key Lock