I crashed Windows 3 ways to seek out the most effective diagnostic software, it is not what Microsoft ships

When a Windows PC crashes, it is onerous to inform what triggered it. Often, it is a dangerous driver or newly put in {hardware} resembling a brand new reminiscence module or a USB machine. However, if that is not the case, the built-in Windows instruments like Event Viewer and Reliability Monitor might be hit and miss. Sometimes they’ll inform what went improper; different occasions they fail to catch the perpetrator.

Surprisingly, the software that may precisely let you know what induced the crash is a Microsoft software, simply not one which comes pre-installed in your PC. I crashed Windows on function 3 ways to seek out which of the built-in instruments can clarify it finest, and WinDbg got here out on high.

Crashing the PC 3 times

A throwaway VM and Microsoft’s personal crash software

I ran every thing inside a Windows 11 VirtualBox VM so no actual {hardware} or information was in danger. The crash software was NotMyFault, a part of Microsoft’s Sysinternals suite of diagnostic utilities, designed to crash Windows on demand. You run it as admin, decide a crash kind, and the system goes down immediately.

I triggered three completely different crashes to see how every software dealt with them. A High IRQL fault, the traditional driver crash. A buffer overflow that corrupts reminiscence. And a stack trash that breaks the decision stack. Each one fails differently, which suggests an excellent diagnostic software ought to catch all of them.

Before crashing, I set Windows to save lots of small reminiscence dumps and turned off computerized restart (System Properties > Advanced > Startup and Recovery) so every crash display stayed on display lengthy sufficient to learn. The buffer overflow did not crash by itself, so I enabled Driver Verifier’s Special Pool examine for NotMyFault’s driver to drive it. After every crash, I checked the identical 4 locations in the identical order: the crash display, Reliability Monitor, Event Viewer, and eventually the dump file in WinDbg.

Reading the crash outcomes

The built-in instruments stopped on the cease code

The crash display was the very first thing I noticed after every crash, and the closest the built-in instruments got here to giving an actual reply. On two of the three crashes (the High IRQL fault and the buffer overflow), it confirmed a What failed line proper beneath the cease code, naming myfault.sys because the responsible driver. On the third crash, a stack corruption with cease code 0x139, it confirmed the cease code alone with no driver identify. The catch is that Windows restarts robotically by default, so most individuals by no means get to learn this display. Nothing saves the data it reveals as soon as the restart occurs.

Next was Reliability Monitor, a tool I’ve relied on to diagnose PC slowdowns prior to now, but it surely wasn’t of a lot assist right here. It recorded each crash, however cut up each into three separate entries, which was complicated. When I clicked View technical particulars, all I received was the cease code, its 4 parameters, and the dump file’s identify. No driver. No trigger.

Event Viewer advised the identical story. The Event 1001 (BugCheck) entry logged the cease code, parameters, and the dump path for every crash, but it surely was buried amongst generic Kernel-Power 41 and Event 6008 entries that solely affirm the system shut down unexpectedly. You must filter by Event ID to seek out the related log, and even then, it offers you an identical restricted info as Reliability Monitor.

To be honest, these instruments aren’t ineffective. They affirm {that a} crash occurred, offer you a cease code you may search on-line, and level to the dump file on disk. They by no means let you know why the crash occurred. Every log I checked finally pointed to the identical place, which is the dump file. That was the one place the total reply lived.

WinDbg remains to be one of the best ways to learn crash experiences

WinDbg named the responsible driver each time

WinDbg named myfault.sys in all three crashes. On the 0x139 crash, the place the crash display and each different built-in software got here up empty, WinDbg was the one one to elucidate the trigger. Its ERROR_CODE line described it as a stack-based buffer overrun, which is precisely what NotMyFault’s stack trash possibility does. That was the one plain-language clarification any software gave throughout all three exams.

I do know it appears to be like like a developer software, and it’s technically one. But the method of utilizing it’s less complicated than it appears. You set up WinDbg from the Microsoft Store or with winget, run it as admin, open the minidump file (saved in C:WindowsMinidump by default), and run !analyze -v. Then search for three traces within the output: BUGCHECK_CODE tells you the cease code, IMAGE_NAME tells you which ones driver crashed, and ERROR_CODE explains the trigger in plain language when out there. In my exams, IMAGE_NAME confirmed myfault.sys each time.

There are some sincere caveats:

• WinDbg wants an web connection the primary time you open a dump as a result of it downloads debugging symbols from Microsoft’s servers.
• The buffer overflow end result additionally had assist from Driver Verifier, which catches the corruption at its supply, so that could be a best-case state of affairs. In real-world crashes with out Verifier working, reminiscence corruption can floor later and blame the improper driver completely.

But even with these limitations, WinDbg discovered the reply in each crash I threw at it, whereas the built-in instruments stopped on the cease code each time.

One last item: be certain that Windows is ready to save lots of small reminiscence dumps. Go to System Properties > Advanced > Startup and Recovery > Settings and set the dump kind to Small reminiscence dump. Without a dump file, WinDbg has nothing to learn.

The finest crash diagnostic is a file Windows already saves

Often, crash codes are what I depend on to seek out the trigger and repair of a crash. You search it, strive a couple of generic fixes, and hope for the most effective. However, Windows writes the true reply to a dump file each time it goes down. The built-in instruments I examined all knew a crash occurred, however none of them may inform me which driver induced it.

Keep small reminiscence dumps turned on and WinDbg put in. The subsequent time your PC crashes, you will know precisely what induced it.