Crash Dump Analysis and Debugging Forum

http://support.citrix.com/article/CTX111072 (requires free registration)

Blog: http://www.dumpanalysis.org/blog/index. ... dump-tool/

It doesn't work on Vista. It says error loading SystemDump.sys. Access is denied

On 32-bit Vista you only need to run SystemDump as administrator (right click on SystemDump.exe and choose "Run as administrator"). Alternatively (if you use command line options) you can use an elevated command prompt: click the Start menu, point to All Programs, point to Accessories, right-click Command Prompt, and then select Run as administrator. Here’s the dump from my Vista installation:

Code: Select all

Loading Dump File [C:\Windows\MEMORY.DMP]
Kernel Summary Dump File: Only kernel address space is available

Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows Vista Kernel Version 6000 UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 6000.16386.x86fre.vista_rtm.061101-2205
Kernel base = 0x81800000 PsLoadedModuleList = 0x81908ab0
Debug session time: Sat Jan 27 20:13:10.917 2007 (GMT+0)
System Uptime: 0 days 1:33:13.589
Loading Kernel Symbols
Loading User Symbols
Loading unloaded module list

BugCheck E2, {cccccccc, 83286f08, a, 0}

Probably caused by : SystemDump.sys ( SystemDump+743 )

64-bit Vista requires more elaborate steps due to driver code signing. In order to use 64-bit SystemDump you have to use F8 Advanced Boot Option (Disable Driver Signature Enforcement) or command line tool BCDedit.

Then you need to run SystemDump64.exe as administrator