Can anyone make sense of this dump file?

[dragonash]

In my on going effort to see just what is causing this well known explorer error in win7, I have gone into advanced measures and downloaded microsofts debugging kit.

I now replicated and captured the error in a dmp file and viewed it in dumpchk.exe


i just dont know what it means! lol
If i upload it, can someone help make sense of it?

[shifty]

Yes. If you'll upload it and let me know when it's uploaded I will help. BUT I would rather tell you how to debug it.

In addition to downloading the debugging tools, you also need to download the symbols file, which is also a hefty download size...after you have both downloaded and installed, you'll need to run dumpchk.exe, press CTRL+D (I think) *or* File>Open Crash Dump, then point it to the Minidump file, and let it parse. If you have the symbols file installed, it will parse the entire file and tell you the symbol or driver file that probably caused the crash in the text at the end of parsing.

[dragonash]

already ahead of you.

I downloaded the symbols (i think i got the correct version) and tried dumpchk out of pure common sense "hey, there is a file called dumpchk... betcha thats what i need" lol

unfortunately, when I run it, it says its not supported anymore. Wow...why include an exe file just to say use something else?

Anyway, I *think* the check was done automatically and a log file was produced... I *think*

I will show you everything once I get home and upload it.... 7pm EST.

The 3 files I have in the folder are (from what I remember)
first chance.dmp
second chance.dmp <- from what i read, this is t he file i want
something.log

edit:
it wasnt dumpchk that gave me that error. It was dumpexam lol
I did however do dump check and didnt really understand it...thats when I made the original post (dumpchk has to be run from the cmd prompt)


files:
dump1.zip (http://cytekonline.com/appz/dump1.zip)
dump2.zip (http://cytekonline.com/appz/dump2.zip)

[dragonash]

bump

[shifty]

Sorry, gonna be tomorrow (late) before I can go download the debugging kit and symbols.

[dragonash]

well...if its any help, I think i can copy and paste my results if need be.

Although its in the cmd prompt. maybe i downloaded the wrong tools?

[shifty]

You go here:

http://www.microsoft.com/whdc/Devtools/Debugging/default.mspx

Using the links, download the applicable symbols package using the first link. Then download the applicable 32-bit or 64-bit debugging tools for your version of Windows.

Install both, and load the dump file using Windbg.exe

[shifty]

Ok, it looks like you're running 64-bit W7. I'm running 32-bit. It's not letting me read the dump file.

Can you make sure you have the correct symbols package installed, run Windbg.exe, File->Open Crash Dump, point to the .dmp files you attached, and when the parsing completes, just take a screen cap of the dump window output?

[dragonash]

Microsoft (R) Windows Debugger Version 6.11.0001.404 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Program Files\Debugging Tools for Windows (x64)\Crash_Mode__Date_12-27-2009__Time_09-58-35AM\PID-3100__EXPLORER.EXE__2nd_chance_AccessViolation__mi ni_139c_2009-12-27_10-19-35-707_0c1c.dmp]
User Mini Dump File: Only registers, stack and portions of memory are available

Comment: '2nd_chance_AccessViolation_exception_in_EXPLORER. EXE_running_on_BEAST-DT'
Symbol search path is: C:\Symbols
Executable search path is:
Windows 7 Version 7600 MP (8 procs) Free x64
Product: WinNt, suite: SingleUserTS
Machine Name:
Debug session time: Sun Dec 27 10:19:36.000 2009 (GMT-5)
System Uptime: not available
Process Uptime: 0 days 0:22:19.000
.................................................. ..............
.................................................. ..............
............................................
This dump file has an exception of interest stored in it.
The stored exception information can be accessed via .ecxr.
(c1c.10f8): Access violation - code c0000005 (first/second chance not available)
ntdll!RtlFreeHeap+0xd0:
00000000`76dd1da0 4c8b6308 mov r12,qword ptr [rbx+8] ds:00000bf5`7e0cc4c8=????????????????

when running the suggested "ecxr" command, I get this

0:021> ecxr
*** ERROR: Symbol file could not be found. Defaulted to export symbols for timounter64.dll -
*** ERROR: Module load completed but symbols could not be loaded for FXSRESM.dll
*** ERROR: Module load completed but symbols could not be loaded for explorer.exe
*** ERROR: Symbol file could not be found. Defaulted to export symbols for tishell64.dll -
*** ERROR: Symbol file could not be found. Defaulted to export symbols for slc.dll -
*** ERROR: Symbol file could not be found. Defaulted to export symbols for msasn1.dll -
Couldn't resolve error at 'cxr'

I used win 7 RTM x64 retail symbols

[dragonash]

god... even without reading the dmp file...this has got to be one of those "growing pain" things with win 7.

It would work fine for a bit, then i get a bunch of errors in a row.
A few happened when i just mouse over a file or folder and it highlights it.

(you should see the stability graph of my system lol)

Oddly enough, ZERO errors while gaming and doing non-windows explorer things