How to read a .dmp

Question

How do I read a protected .dmp file from Event Viewer?

Answer 1

A protected .dmp file can be read after it is decrypted, then opened in a debugger.

1. Install Debugging Tools for Windows.
2. If the dump is encrypted, decrypt it with KernelDumpDecrypt.exe:

      KernelDumpDecrypt.exe memory.dmp memory_decr.dmp
   

   This requires the certificate, including the private key, to be present in the current user certificate store.
3. Open the decrypted dump in WinDbg or KD.

Example command:

windbg -y srv*C:\Symbols*https://msdl.microsoft.com/download/symbols -i C:\Windows\i386 -z C:\Windows\Minidump\memory_decr.dmp

Or with KD:

kd -y srv*C:\Symbols*https://msdl.microsoft.com/download/symbols -i C:\Windows\i386 -z C:\Windows\Minidump\memory_decr.dmp

Useful commands after opening the dump:

• !analyze -show to display the Stop error code and parameters
• !analyze -v for verbose analysis
• lm N T to list loaded modules and drivers

If only verifying that the dump file is valid, Dumpchk.exe can read or verify a memory dump file.

---

References:

• About dump encryption
• How to read the small memory dump file that is created by Windows if a crash occurs

Answer 2

1

Please check to see if your PC is producing any small Watchdog dump files, I will check those to see if they provide any insight into a potential cause of the system crashes.

Open Windows File Explorer.

Navigate to C:\Windows\LiveKernelReports

If there are any Watchdog dump files in the sub-folders of that folder, copy the files onto your Desktop, then zip those up.

Upload the zip file to the Cloud (OneDrive... etc.), then choose to share those and get a share link.

Then post the link here to the zip file, so I can take a look for you.

2

Please also provide some information on the problems you are experiencing, is your system crashing to a BSOD or just freezing up...etc. and what are you doing on your PC when the problems occur.