windbg

Could not find the ... dump file, Win32 error 0n87 when opening SYS

I tried loading a SYS file into WinDbg via File/ Open Crash Dump and it keeps saying

Could not find the C:\Windows[...]\win32k.sys Dump File, Win32 error 0n87

Invalid parameter

Screenshot

I checked multiple times with different tools: the file exists. There must be a different problem.

Solution

  • In the background, WinDbg shows the command window with additional information. Once you click the "Ok" button, that information disappears, so keep the dialog open.

    In your case, it may show something like

    Loading dump file [C:\Windows\[...]\win32k.sys]
Could not match Dump File signature - invalid file format
Could not open dump file [C:\Windows\[...]\win32k.sys], Win32 error 0n87
Invalid parameter

    The second line clearly indicates that WinDbg was able to find the file, but still unable to open the file.

    If you have a hex editor available, you'll see that WinDbg cannot open SYS files that start with DCD (a file format that I don't know in more detail) but will be able to open SYS files that start with MZ (the Portable Executable format).

    Thanks to @magicandre1981 in the comments: Windows compacts files in the WinSXS directory. lzmsexpand can uncompress those files.