The client which uses my application gets crashes, so they sent me these two files WER178D.tmp.hdmp
and WER1868.tmp.mdmp
. I open first of it in WinDbg. Unfortunately I have no idea what to do here. I know this is way too broad of a question, but can I please get some initial guidance?

- 55,411
- 20
- 125
- 222

- 8,348
- 7
- 49
- 78
-
1Try following this tutorial http://forums.majorgeeks.com/index.php?threads/how-to-debug-memory-dumps-figure-out-what-is-causing-a-bsod.35246/ – BugFinder Feb 24 '17 at 08:09
-
1Hope this blog is useful for you http://stevestechspot.com/ – Feiyu Zhou Feb 24 '17 at 08:29
1 Answers
First, make sure you're using the right version of WinDbg. Use the 64 bit version of 64 bit crash dumps and the 32 bit version for 32 bit crash dumps. (I can see from the registers and the addresses, you seem to have done that right.)
Next, fix your symbols. Without correct symbols, you might get wrong or misleading results.
If you have no clue, try !analyze -v
; for exceptions continue as below.
If you know it's an exception, switch to the exception record with .ecxr
(you have done that).
Print the native exception details with .exr -1
. If the exception code is 0xE0434F4D
, then it's a .NET exception. Be aware that there are some exceptions which do not have that code but still are .NET exceptions (e.g. Access violation
which could be a NullReferenceException
).
If it's a .NET application, load the .NET extension sos with
.loadby sos clr
.loadby sos mscorwks
.loadby sos coreclr
for .NET 4, .NET 2 and Silverlight/.NET Core respectively. It succeeded if you don't get an error message.
Use !pe
to print the details of the managed exception.

- 1
- 1

- 55,411
- 20
- 125
- 222