Debugging Tools, Vista Blue Screen Death Ultimate weapon

Blue Screen of Death for Windows 2000/XP/Server 2003 and Windows Vista systems is a permanent pain for many people. Once Windows has a blue screen of death, it is often unpredictable to face the error code on the screen. If you encounter a blue screen of death, we can first determine the cause of the fault based on the blue screen error prompt code displayed on the screen. The Microsoft KB Knowledge Base article lists some common blue screen error messages for us, such as 0x000000D1 errors, which are usually caused by improper configuration of hardware device drivers; 0x000000EA errors, usually related to improper display settings on the graphics card, and so on. However, if you can't find a description of the blue screen error message in the Microsoft Knowledge Base, how should we understand the cause of the failure?

To help us analyze the triggering of the blue screen of death, Windows 2000/XP/Server 2003 and Windows Vista systems provide us with the ability to save Crash Dump Files. We can go to the Control Panel in Windows, open the "System" property, switch to the "Advanced" tab, and then open the "Startup and Recovery" option, under "Write debug information" "Small memory dump (64KB)", "core memory dump" or "core memory dump", in order to automatically save the memory dump file in the event of a blue screen of death, so we can The memory dump file recorded when the blue screen of death crashes to determine the cause of the failure. As shown in the screenshot of the attachment.

A memory dump file is a file with a .DMP extension. Among them, the "small memory dump" file is saved in the Windows\\Minidump folder, the file size is 64KB, it only records the key information when a blue screen of death occurs; "core memory dump" & "quo"; The dump & rdquo; files are saved in the Windows folder, the file name is MEMORY.DMP, they record the core memory information and complete memory information when a blue screen of death occurs. In order to save hard disk space, we usually choose “small memory dump”.

So, how do we analyze the cause of the blue screen of death through the .DMP memory dump file? This can be done with the official Debugging Tools for Windows tool provided by Microsoft. We can go to the following address on the official Microsoft website:

Applicable system: 32-bit or 64-bit Microsoft Windows Server 2003, 32-bit or 64-bit Windows XP, Windows 2000, Windows NT 4.0, Windows Vista , or Windows Server 2008.

Download Debugging Tools to install, then launch Debugging Tools, select "ldquo;File" ”-“Open Crash Dump" in the main menu of the program, open .DMP The memory dump file is fine. Debugging Tools can automatically analyze the memory information recorded by the memory dump file during the blue screen of death and analyze the possible causes of the failure.

Figure 1 Debugging Tools installation interface

For example, there was a Windows XP computer frequent error code 0x0000007F blue screen failure, the cause is unknown. In order to investigate the cause of the failure, I set up a Save “small memory dump file (64KB) in Windows XP. When the computer has a 0x0000007F blue screen failure again, after restarting Windows, use the Debugging Tools to open the .DMP memory dump file saved in the Windows\\Minidump folder of this computer. After the automatic analysis, the Debugging Tools pops up an analysis. Report, report this error "Probably caused by TM_CFW.SYS (may be caused by the TM_CFW.SYS file) ”. Originally, TM_CFW.SYS is located in the %SystemRoot%\\system32\\drivers folder, which is a trending firewall program that loads Trend Firewall with Windows startup as a system service. After recollection, this computer often appears 0x0000007F blue screen error after modifying the settings of the trend firewall program. Therefore, the trend firewall is likely to have a problem with improper settings. In order to confirm this conjecture, the author uninstalled the trend firewall in Windows XP through the "Control Panel" - "Add and remove programs", and then re-installed it according to the default settings, and the problem was solved.