Collecting and analyzing BERT file

Intel(R) Debug Extensions for WinDbg* provides a way to collect crashlog information, BERT (Boot Error Region Table) and CPER (Common Platform Error Record), and analyze them using Intel(R) crashlog tool.

To collect information about a Stop error from target or memory dump:

1. Ensure that the target is connected.

2. Launch Python* console for WinDbg* any of the following ways:

   • Click the desktop icon or open the Start Menu and search for Intel(R) Debug Extensions for WinDbg* <year> NDA <version>.

   • Run windbg_​iajtag_​console.bat located at <install_​dir>\system_​debugger\<version>.

   • Launch isd_​shell.bat located in the root installation directory and run windbg_​dci to invoke WinDbg*.

3. In the launched console, run the following command to collect crashlog information:

   regs, analysis = forensic.analyze_crashlog(dumpfile=<dumpfile>)
   

   where <dumpfile> is the path to the input dump file to analyze. If no dumpfile is introduced, it will attempt to extract crashlog information from the target.

One common use-case of this feature is for debugging BSOD issues caused due to Machine Check Exceptions (e.g., Bug Check 0x124: WHEA_​UNCORRECTABLE_​ERROR). Let us see an example of how to extract Crash Log data using a memory dump file extracted on a system where BSOD has occured:

1. Launch WinDbg Python Console as described above.

2. Run the below command:

   regs, analysis = forensic.analyze_​crashlog(dumpfile=r"C:\temp\whea.dmp", timeout=60000)

   where C:\temp\whea.dmp is the path where the memory dump file to be analyzed is stored. User can modify this path based on the exact location of the memory dump file on the host machine.

3. The command will extract the Crash Log information present in the CPER (Common Platform Error Record) and export it to a BERT file. It also shows the Crash Log triage output by default as shown in the figure below. The command and output Crash Log info is highlighed using green boxes.