How the MEMORY.DMP analyser reads crash dumps in the browser

1. The browser opens the file

   You choose the dump from your own disk. The page reads it with the browser file API and hands the work to a background thread, so the tab keeps responding while the parse runs. No request carries the bytes off the machine.

2. Byte-range reads, so size stops mattering

   We seek to the header, the bugcheck block and the loaded module list instead of swallowing the whole file. A 16 GB MEMORY.DMP is handled the same way as a 300 KB minidump. There is no upload cap and no queue to wait in.

3. Parser first, then the reference library

   The stop code, its parameters, the faulting module and the driver list all come out of the file structure. Each one is matched against maintained pages for stop codes, drivers, exception codes, certificate fields, registry locations and file types.

4. Every observation carries a source field

   The evidence ledger records where each finding came from: the dump header, the module list, or a library entry. When the evidence is thin, the confidence drops and the report says so. We would rather print an honest maybe than a confident guess.

5. Take the report away with you

   Copy, download or print it as Markdown or plain text, then paste it into a forum post or a support ticket. We keep nothing from the file, so the copy on your machine is the only copy that exists.

1. BSOD Dump Analyzer

   Read a blue-screen minidump or MEMORY.DMP in the browser. Returns the stop code, the blamed driver, a fix plan and the evidence behind it, and explains why ntoskrnl.exe is usually the victim rather than the root cause.

2. WER and App Crash Reader

   Open Windows Error Reporting files and app-crash minidumps to find the faulting module and exception code. Explains that a .wer file is a summary, not a full dump.

3. Certificate Decoder

   Decode SSL and X.509 certificates, CSRs, keys and PFX files to show subject, issuer, expiry, SANs and fingerprints. Works offline, so there is no revocation check and the issuer signature is not proven against a trusted root.

4. .reg File Viewer

   Read a registry file before you run it, with the keys, value types and locations laid out in plain language. Never stamps a file safe, and notes that a merge cannot be undone.

Frequently Asked Questions

Does my dump get uploaded anywhere?

No. The file is opened by your browser, from your disk, and parsed on a background thread on your machine. No request carries the dump bytes to us or to anyone else, so there is nothing for us to store, log or leak.

Is there a size limit on a MEMORY.DMP?

No. Because we use byte-range reads and only touch the parts of the file that matter, a 16 GB MEMORY.DMP is handled the same way as a 300 KB minidump. There is no upload cap, no paid tier for big files and no queue.

What is actually in the report?

Six parts, in this order: the verdict with its confidence and the reason for it, what to do next, how we know, the details, take it away, and a technical appendix. The take it away part is the copy, download or print step for Markdown or plain text.

The dump blames ntoskrnl.exe. Is that the cause?

Usually not. The Windows kernel is often the thread that was running when something else misbehaved, so it gets named as the victim rather than the culprit. The analyser looks past it at the driver list and the stop code parameters before it commits to a verdict.

What does the optional AI second opinion see?

Only the short deterministic report text, never the file and never the dump bytes. It is rate limited, it sits after the report rather than in front of it, and the full report stands alone if you leave it switched off or if it errors.

Can you tell me a .reg file or a certificate is safe?

No. We show you what is inside: the keys and value types in a .reg, the subject, issuer, expiry and fingerprints in a certificate. Offline there is no revocation check and no live antivirus scan, and knowing a file's format is not the same as knowing it is safe.