MEMORY DUMP
Normal
0
false
false
false
EN-US
X-NONE
X-NONE
MicrosoftInternetExplorer4
/* Style Definitions */
table.MsoNormalTable
{mso-style-name:"Table Normal";
mso-tstyle-rowband-size:0;
mso-tstyle-colband-size:0;
mso-style-noshow:yes;
mso-style-priority:99;
mso-style-qformat:yes;
mso-style-parent:"";
mso-padding-alt:0in 5.4pt 0in 5.4pt;
mso-para-margin:0in;
mso-para-margin-bottom:.0001pt;
mso-pagination:widow-orphan;
font-size:10.0pt;
font-family:"Times New Roman","serif";}
Title: - Points to remember while collecting memory dump.
Symptoms: -
Ø No dump file
Ø Corrupt dump file
Cause: -
Ø No Paging file
Ø Paging file on a different drive
Ø Page file size not appropriate
Ø No space on the C drive
Ø ASR Software
Ø Old SCSI drivers
Solution: -
Ø Set the path of the dump to C drive
Ø Page file should exist. In case it doesn’t then the dump will not be generated.
Ø The size of the page file should be more than the physical RAM.
Ø The recommended size is 1.5 times more than the physical RAM
Ø Enough space for the dump file on the C drive
Ø A complete memory dump is almost equal to the size of the physical RAM
Ø ASR (Automatic Server Recovery) software can cause an issue when we try to get a dump file
Ø They should be turned OFF in scenario’s where we face an issue collecting the dump
Ø Old SCSI drivers are also responsible for the non creation of dump
Ø Microsoft has a tool namely Dumpchk.exe which checks whether the dump is GOOD.
Ø Dumpchk.exe is a command-line utility you can use to verify that a memory dump file has been created correctly.
Ø Dumpchk.exe does not require access to symbols.
Ø You can download debugging tools for Windows products from the following Microsoft Web site:
http://www.microsoft.com/whdc/DevTools/Debugging/default.mspx (http://www.microsoft.com/whdc/DevTools/Debugging/d...)
The Security Community Blog is the perfect place to share short, timely insights including product tips, news and other information relevant to the Security community. Any authenticated Connect member can contribute to this blog.
Comments
Nice work Sandeep :)
will help in BSOD cases.
Please don't forget to mark your thread solved with whatever answer helped you : ) Rafeeq
If you are starting off with
If you are starting off with studying dumps, "bang analyze dash vee" would be effective.
De facto when AV does something, it starts jumping up and down, waving its arms, and shouting "Hey! I found a virus! Look at me! I'm soooo goooood!"
Would you like to reply?
Login or Register to post your comment.