Minidump - viewing content of memory address
I have a Windows 10 minidump with this opening text (viewed in WinDbg):
KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common BugCheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff805068027f6, The address that the exception occurred at
Arg3: 0000000000000000, Parameter 0 of the exception
Arg4: ffffffffffffffff, Parameter 1 of the exception
Let's say I wanted to investigate the exception address to find out if there is indeed information about a driver or a function there: How do I go about it?
I've tried various formats of the d
, dd
, ds
and so forth, but it either gives me ?????
or some other type of gibberish, for example:
9: kd> dW fffff805068027f6
fffff805`068027f6 8b48 2040 3b4c 0fc0 9384 0000 7200 0f2a H.@ L;.......r*.
It feels like I'm missing something rudimentary, and though I've googled extensively I can't really figure out where I'm even lost.
It would be far simpler to use the free BlueScreenView, which does the analysis work for you: