BSoD 0x3B - system doesn't create dump files

M

MrPepka

Sysnative Staff, BSOD Kernel Dump Senior Analyst
Staff member
Joined
Feb 17, 2019
Posts
534
I have such a problem with the blue screen. Trying to run Aorus Engine, a blue screen is displayed with error code 0x3B referencing the gdrv.sys driver (driver from GIGABYTE APPCenter). Like everything is clear, however, I wanted to debug the memory dump. The problem is that the system does not create memory dumps. I saw similar problems there, however, it looked like the creation of the memory dump hung at a certain percentage (0%, 50% etc.). And my system doesn't even try to create such a dump. There is info on the blue screen that "The computer has encountered a problem and needs to be shut down. You can now restart it." There is not even a message that "the memory dump is being created" or something. How do you force the system to finally create a memory dump?
 
I know this topic, I meet all the conditions described there (the swap file is on the same disk as the system, larger than RAM and managed by the system, the Windows Error Reporting service is set to Manual)
 
Checked in the event logs for any issues during or before the crashes?
 
I don't have any CCleaner programs to clean my computer. And in the event log, except the entry that the system was shut down without first clean shutdown, there is nothing else. But I found out that for some reason the memory dump driver is not loaded on the system. So how do you load it?
 
Thanks for the answer. From what I see it is responsible for generating memory dumps driver crashdmp.sys which in my system is not loaded at all. So what should I do? How to load this driver into the system?
 
Not generating a dump happens for one of a few common reasons:
1. A process crashes (lsass or csrss) that controls access to the security subsystem, meaning permissions checking fails, and crasdump cannot write due to lacking permissions to write to the paging file (where memory sump data is written).
2. The system memory committed at time of a system crash is larger than the paging file's size when the crash occurs, resulting in a hung or failed dump write to disk.
3. A driver or process that is "boot critical" or hooks kernel APIs crashes or hangs during the bugcheck, thus causing a crash of the crash, and no dump is written.

There could be others, but those are the most common I've run into over the last 15 years or so, and in that order of most common to less common.
 
My reason is that the system doesn't load the driver responsible for generating memory dumps, but I don't know how to fix it. I checked all possible variants and the only thing that doesn't match is that the crash dump driver is unloaded
 
Without a kernel debugger attached, the crash process cannot be interrogated to see what's happening.

Also, if your system crashes and starts dumping memory to disk (even if it hangs or fails), it did load.
 
And isn't it just that the dump drivers are loaded all the time? That's how it worked in Windows 8.1. Drivers like crashdmp.sys or diskdump.sys were still loaded. Is it different in Windows 10?
 
sfc /scannow Plus the DISM options too. DISM /Online /Cleanup-Image /RestoreHealth followed again by the sfc /scannow again.

I also read where the hiberfil.sys can stop a dump if corrupted.

You can try the powercfg -h off command to turn that off.
 
Also checked and that's not it. If you have Windows 10, check in Driver Verifier (you do not need to turn it on, just enter Driver Verifier Manager) and see in the loaded drivers whether you have the drivers crashdmp.sys and diskump.sys
 
crashdump driver verifier.png
Here is what I have. Win 10 1909 I'm not sure about the unknown part. It's listed in the DRT as:
SourceWindows Update or 3rd party driver manufacturer, depending on the source driver
 
Well then you are right. For me, these drivers are not on the list although the drivers themselves are in the system. And that's why memory dumps are probably not created because the drivers responsible for it do not work (the system does not load them). But how do these drivers load into the system?
 

Has Sysnative Forums helped you? Please consider donating to help us support the site!

Back
Top