Minidump Browser

Minidump Browser is a software tool that allows to you to examine the contents of a minidump or kernel dump. The minidump might result from an application crash or a minidump created as part of some application profiling. A kernel dump will have been written when the operating system crashed, providing the infamous Blue Screen of Death.

Typically the only way to interact with a minidump or kernel dump is to load it into a debugger and see where the application that generated the minidump crashed.

Minidumps can also be generated without a crash being required, and crash minidumps can contain a lot more information than just information about an exception.

That’s why we created Minidump Browser. Now you can inspect memory protection regions, thread information, including thread names, open handles at the time of the crash, and various information about the host computer hardware, and it’s performance.

Viewing Minidumps

When viewing a minidump, the following information displays are available.

Processor architectures

Minidumps from both x86 and x64 processors are supported.

For any minidumps that refuse to load, which is typically caused by unsupported data sizes for particular sections of a minidump, we can also display those minidumps. This allows us to display minidumps from ARM and IA64 systems.

Exception

We display the exception information plus some additional information we can calculate: symbol name, filename, line number, DLL name.

You can copy the exception details to a text file, or use DbgHelp Browser, TDS Browser, Map File Browser to find the crash address details (symbol name, filename, line number) in debugging information.

Handles

The handles in use at the time of the minidump. The handle, the type of the handle and when that handle is file related, the path to the file.

Memory Info

The memory blocks in use at the time of the minidump.

If you’re curious about visualising these memory protections, load your minidump into VM Validator.

Misc Info

Miscellaneous information about the hardware and operating system at the time of the minidump.

Modules

Information about the currently loaded modules at the time of the minidump.

Threads

Information about the running threads in the process at the time of the minidump.

Not all threads have names. Learn how to name Threads.

System Info

Information about the computer the program was running on at the time of the minidump.

System Memory Info

Information about the computer memory at the time of the minidump.

Unloaded Modules

Information about modules that have been unloaded from the program prior to the minidump.

VM Counters

Information about the many memory counters contained in the minidump.

Viewing the virtual memory in a minidump

To view the virtual memory described by data in a minidump you need to load the minidump into Virtual Memory Validator.

Viewing Kernel dumps

When viewing a kernel dump, the following information displays are available.

Header

General information about the Kernel Dump header.

Bug Check 

Information about the BugCheck, the parameters and a link to the official Microsoft documentation for this BugCheck.

Exception

Information about the Exception.

Attributes

Information about the attributes for the Kernel Dump.

Other

Additional miscellaneous information about the Kernel Dump.

Pointers

The pointers included in the Kernel Dump.