Microsoft KB Archive/160655

= Dumpchk is Version Specific in Windows NT 4.0 =

PSS ID Number: 160655

Article Last Modified on 5/13/2003

-

The information in this article applies to:


 * Microsoft Windows NT Workstation 3.5
 * Microsoft Windows NT Workstation 3.51
 * Microsoft Windows NT Workstation 4.0
 * Microsoft Windows NT Server 3.5
 * Microsoft Windows NT Server 3.51
 * Microsoft Windows NT Server 4.0

-



This article was previously published under Q160655



SUMMARY
The Windows NT 3.51 Dumpchk.exe program will produce erroneous output if it is run against a memory dump generated by a Windows NT 4.0 installation. Inaccurate and unpredictable results will be in the dumpchk validation report as shown below.

NOTE: There is no size limitations on memory dump files that dumpchk.exe can run against. Dump files as large as 1GB has been tested with accurate results.

************** Error: could not read base of PsLoadedModuleList
 * --> Validating the integrity of the PsLoadedModuleLi


 * --> Performing a complete check (^C to end)
 * --> Validating all physical addresses
 * --> Validating all virtual addresses
 * --> Validating all physical addresses
 * --> Validating all virtual addresses
 * --> Validating all virtual addresses
 * --> Validating all virtual addresses
 * --> Validating all virtual addresses

Total errors = xx

-or-

**************
 * --> Performing a complete check (^C to end)

Error: memory read failed 0x80600000 pfn=400 pde=201, pte=200 ptepage=5617000 vapage=5298000 loc=38000 Error: memory read failed 0x80601000 pfn=400 pde=201, pte=201 ptepage=5617000 vapage=5298000 loc=38000
 * --> Validating all physical addresses
 * --> Validating all virtual addresses
 * --> Validating all virtual addresses
 * --> Validating all virtual addresses
 * --> Validating all virtual addresses

Total errors = xx



MORE INFORMATION
The Dumpchk.exe utility is backwards compatible. Versions of dumpchk equal or greater than the version of Windows NT where the memory dump was generated needs to be used.

In cases where dumpchk is run against incomplete memory dumps (system is transferring the dump to pagefile or from pagefile to %SystemRoot%\Memory.dmp) similar inaccurate results will be included in dumpchk output.

Additional query words: validating virtual addresses

Keywords: KB160655

Technology: kbWinNT350search kbWinNT351search kbWinNT400search kbWinNTS350 kbWinNTS350search kbWinNTS351 kbWinNTS351search kbWinNTS400 kbWinNTS400search kbWinNTsearch kbWinNTSsearch kbWinNTW350 kbWinNTW350search kbWinNTW351 kbWinNTW351search kbWinNTW400 kbWinNTW400search kbWinNTWsearch

-

[mailto:TECHNET@MICROSOFT.COM Send feedback to Microsoft]

© 2004 Microsoft Corporation. All rights reserved.