Every computer user knows that frustrated, sinking feeling that occurs when a system crash strikes. System crashes happen without warning and result in slashed productivity, exasperated users, và sometimes lost work.
Bạn đang xem: File dmp là gì? cách mở file dmp trong windows 10
Advertisement
A “dump” is a record of the computer’s state at the moment of a crash. Dump files are automatically generated by Windows when a crash occurs. They are used by developers và advanced users to lớn help figure out what caused the crash. DMP is the tệp tin extension Windows uses for dump files.
video of the Day
DMP file Data Format
There are three types of memory dumps that can be generated by Windows. The first, & largest, is called a complete memory dump. When this type of dump is created, the total contents of memory are written khổng lồ a DMP file.
Advertisement
The second, và notably smaller, dump type is the kernel memory dump. As its name implies, a kernel memory dump records only the kernel memory. Unallocated memory & any memory allocated khổng lồ user-mode programs is ignored. This makes analyzing the dump file easier and less time-consuming than with a complete memory dump.
The third & most compact type of dump, called a small memory dump, generates a DMP file that is just 64 kilobytes in size. It includes only the following information: the Stop message and its parameters, a danh mục of loaded drivers, the processor context (PRCB) for the stopped processor, the process information & kernel context (EPROCESS) data, the process data và kernel context (ETHREAD) for the stopped thread, và the Kernel-mode gọi stack for the stopped thread.
Advertisement
How to lớn Locate a DMP file
By default, complete memory dumps & kernel memory dumps are both written khổng lồ %SystemRoot%Memory.dmp. Windows only saves one of these dump files at a time. When a new crash occurs, the existing DMP file is overwritten.
DMP files generated by a small memory dump, however, are saved in the %SystemRoot%Minidump directory. Unlike other dump types, existing small memory dump files are not overwritten when new ones are generated.
Advertisement
Windows automatically includes the date in the filename of small memory dump DMP files. For instance, a DMP tệp tin with the name “mini043014-01.dmp” was created on April 30, 2014. The “-01” following the date in the filename indicates that it was the first DMP file created on that day.
Opening & Viewing a DMP tệp tin
There are two main software applications used to mở cửa and view DMP files: Windows Debugging Tools & the Dump check Utility, also called Dumpchk. Windows Debugging Tools is the best option for examining complete memory dumps & kernel memory dumps, while Dumpchk is ideal for looking at small memory dumps. Both applications can be downloaded for free from Microsoft’s website. Since the exact URLs may change over time, it is best to search for the programs by name at http://www.microsoft.com & then tải về from the resulting links.
Advertisement
To examine a DMP tệp tin using Windows Debugging Tools, mở cửa a command prompt and navigate khổng lồ the thư mục where you installed Windows Debugging Tools. Then, enter one of the following commands to mở cửa the file:
windbg -y SymbolPath -i ImagePath -z DumpFilePath
kd -y SymbolPath -i ImagePath -z DumpFilePath
The first command will open the DMP file in Window’s GUI debugger, while the second command will open it in a text-based interface. The SymbolPath parameter refers khổng lồ the location of the debugging symbols on your hard drive. The ImagePath parameter refers khổng lồ the location of your image files. Finally, the DumpFilePath parameter is the location of your DMP file.
Advertisement
To open a DMP file in Dumpchk, simply type the following command into a command prompt:
dumpchk DumpFilePath
Analyzing the Contents of a DMP file
Windows Debugging Tools offer a number of helpful commands for analyzing DMP files. The !analyze -show command outputs the Stop error code & its parameters. This is useful for figuring out what, exactly, directly led to the crash. The !analyze -v command displays the same information as verbose output. The lm N T command displays a list of loaded modules at the time of the crash.
Xem thêm: Mã Bic Là Gì - Bic Là Gì Định Nghĩa Của Bic Code Là Gì
Advertisement
Compared khổng lồ Windows Debugging Tools, Dumpchk is a fairly simple utility. It is primarily used to verify the integrity of dump files và to view them. To thử nghiệm a dump file for errors, you can use the -e command line extension. For example, you would type the following at the command line:
dumpchk -e DumpFilePath
Other Dumpchk options include -v, which turns on verbose mode, -p, which outputs the DMP header only, & -c, which performs a quick dump validation.