KnowledgeBase Archive

An Archive of Early Microsoft KnowledgeBase Articles

View on GitHub

Q160655: Dumpchk is Version Specific in Windows NT 4.0

Article: Q160655
Product(s): Microsoft Windows NT
Version(s): WinNT:3.51,4.0
Operating System(s): 
Keyword(s): kbtool
Last Modified: 10-AUG-2001

-------------------------------------------------------------------------------
The information in this article applies to:

- Microsoft Windows NT Workstation versions 3.5, 3.51, 4.0 
- Microsoft Windows NT Server versions 3.5, 3.51, 4.0 
-------------------------------------------------------------------------------

SUMMARY
=======

The Windows NT 3.51 Dumpchk.exe program will produce erroneous output if it is
run against a memory dump generated by a Windows NT 4.0 installation. Inaccurate
and unpredictable results will be in the dumpchk validation report as shown
below.

NOTE: There is no size limitations on memory dump files that dumpchk.exe can run
against. Dump files as large as 1GB has been tested with accurate results.

**************
**************--> Validating the integrity of the PsLoadedModuleLi
**************
Error: could not read base of PsLoadedModuleList

**************
**************--> Performing a complete check (^C to end)
**************
**************
**************--> Validating all physical addresses
**************
**************
**************--> Validating all virtual addresses
**************

Total errors = xx

-or-

**************
**************--> Performing a complete check (^C to end)
**************

**************
**************--> Validating all physical addresses
**************
**************
**************--> Validating all virtual addresses
**************
    Error: memory read failed 0x80600000 pfn=400 pde=201, pte=200
    ptepage=5617000 vapage=5298000 loc=38000
    Error: memory read failed 0x80601000 pfn=400 pde=201, pte=201
    ptepage=5617000 vapage=5298000 loc=38000

Total errors = xx

MORE INFORMATION
================

The Dumpchk.exe utility is backwards compatible. Versions of dumpchk equal or
greater than the version of Windows NT where the memory dump was generated needs
to be used.

In cases where dumpchk is run against incomplete memory dumps (system is
transferring the dump to pagefile or from pagefile to %SystemRoot%\Memory.dmp)
similar inaccurate results will be included in dumpchk output.

Additional query words: validating virtual addresses
======================================================================
Keywords          : kbtool 
Technology        : kbWinNTsearch kbWinNTWsearch kbWinNTW400 kbWinNTW400search kbWinNT351search kbWinNT350search kbWinNT400search kbWinNTW350 kbWinNTW350search kbWinNTW351search kbWinNTW351 kbWinNTSsearch kbWinNTS400search kbWinNTS400 kbWinNTS351 kbWinNTS350 kbWinNTS351search kbWinNTS350search
Version           : WinNT:3.51,4.0

=============================================================================

THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. MICROSOFT DISCLAIMS ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. IN NO EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. SOME STATES DO NOT ALLOW THE EXCLUSION OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES SO THE FOREGOING LIMITATION MAY NOT APPLY.