Basic information obtained through simple dump

If an error occursProgramEven if dump is not obtained at the right time, it can analyze useful information.

• Use vertarget to view the system version and how long the system has been running.
• Pass! Peb checks the environment variables. Because many third-party software is used to adding its own path to the environment variables, we can often see some installed software.
• You can also see the DLL and corresponding path loaded by the current process.

When checking the DLL and the corresponding path, you can focus on the following items:

1. Is there any anti-virus program DLL loaded.
2. Is there a debug DLL load similar to msvcrtd or mfc42d? If yes, check whether some components used by the program are compiled in debug mode.
3. Through the DLL such as mfc42, You can roughly determine how the program is developed. For example, whether to use MFC or ATL. If mscoree is loaded, ask whether the program is hosted.Code.
4. Run the lmvm command to check the detailed version and company name of the suspect DLL. You can also use SOS if necessary! The savemodule command saves the DLL locally to check the link status.
5. Run the lMF command to check whether the unload module exists. many problems are caused by the unload of the module being used, and some modules are finally unloaded. check whether the unload module is normal.
6. Check the number of modules and whether a dynamically generated module is loaded. if too many modules are loaded in the process, memory address fragments may occur. for example, for Asp.net programs, many modules are generated based on the dynamic compilation of aspx pages. You need to set DEBUG = false to activate batch compilation to reduce the generation of dynamic modules.
7. The dump file size is used to determine the memory usage. Generally, the dump size is the same as the actual memory size.
8. Check some system DLL to check whether some system components have been updated to the latest version. for example, you can check the version of mscorwks.. NET Framework Version and whether SP1. check msado15 to determine the MDAC version.

From <efficient troubleshooting of Windows user-State Programs>