MDMP File Documentation

Summary

An MDMP file is a Windows Minidump, a compact snapshot of a program’s (or Windows’) state captured at the moment it crashed. It is a diagnostic file for developers, not a document: it records the faulting thread’s call stack, CPU registers, loaded modules and selected memory, written through Microsoft’s MiniDumpWriteDump API. Its MIME type is application/x-msdownload. You open it in a debugger such as WinDbg or Visual Studio; for an ordinary user it is usually safe to delete. It is the same format as a DMP.

Technical details

FeatureValue
Full nameWindows Minidump File
File extension.mdmp (also written as .dmp)
MIME typeapplication/x-msdownload
Format typeCrash-dump container (binary)
DeveloperMicrosoft
IntroducedEarly 2000s (MiniDumpWriteDump API, Windows XP / Visual Studio era)
Written byMiniDumpWriteDump, Windows Error Reporting, Breakpad/Crashpad
Byte orderLittle-endian
Magic number4D 44 4D 50 (“MDMP”, 0x504D444D) at offset 0
HeaderMINIDUMP_HEADER: signature, version, stream count, directory RVA, checksum, timestamp, flags
Directory entryMINIDUMP_DIRECTORY: stream type + location descriptor (size + RVA)
Key streamsThreadList, ModuleList, Exception, SystemInfo, Memory / Memory64
OffsetsRVA (relative virtual address) from file start
Open standardNo (proprietary; API documented by Microsoft)
Analyzed withWinDbg, Visual Studio, BlueScreenView/WhoCrashed (BSOD dumps)
NeedsMatching PDB symbols and module binaries for a readable stack
Safe to deleteYes, unless a developer requested it
PrivacyMay contain live memory: paths, tokens, passwords, document fragments
Related extensions.dmp, .hdmp, .wer, .core
Specification URLlearn.microsoft.com/…/nf-minidumpapiset-minidumpwritedump
File signature (magic bytes)
4D 44 4D 50

Offset 0, ASCII MDMP. Read as a little-endian 32-bit value this is MINIDUMP_SIGNATURE = 0x504D444D, the first field of the MINIDUMP_HEADER. A 16-bit version follows (its low word is the format version). Kernel full-memory dumps (MEMORY.DMP) are a different type and start with PAGEDU64/PAGEDUMP instead, though they share the .dmp extension.

What is an MDMP file?

An MDMP file is a Windows minidump, a crash-dump written by Windows or by an application when it crashes or hangs. Microsoft introduced the format with the MiniDumpWriteDump API in the Windows XP and Visual Studio era of the early 2000s. Rather than saving a program’s entire memory, which can run to gigabytes, a minidump captures a compact, targeted snapshot: the exception that occurred, the thread that faulted, every thread’s call stack and CPU registers, the list of loaded modules with their versions, and optionally selected regions of memory. That is enough for a developer to reconstruct what the program was doing at the instant it failed.

An .mdmp is a passive diagnostic artifact, not a document you read directly and not a program you run. To make sense of one you load it into a debugger, which combines the dump with matching symbol files to produce a human-readable stack. The .mdmp and .dmp extensions name the same minidump format; this page uses .mdmp, and everything here applies equally to a minidump saved as .dmp.

The MINIDUMP_HEADER, field by field

Every minidump opens with a fixed MINIDUMP_HEADER. It is small, and its whole job is to point at the stream directory that indexes the rest of the file.

MINIDUMP_HEADER
  Signature          uint32   'MDMP' = 0x504D444D
  Version            uint32   low word = format version; high word implementation-specific
  NumberOfStreams    uint32   how many streams the directory lists
  StreamDirectoryRva uint32   file offset (RVA) of the stream directory array
  CheckSum           uint32   optional header checksum (often 0)
  TimeDateStamp      uint32   time_t the dump was written
  Flags              uint64   MINIDUMP_TYPE bitmask: what was included

The first field is the signature MDMP, which as a little-endian 32-bit integer is 0x504D444D. Version follows; only its low 16 bits are the documented format version, the high 16 bits being an internal value. NumberOfStreams and StreamDirectoryRva are the load-bearing pair: they say how many streams exist and where in the file the directory that describes them begins. Every offset in a minidump is an RVA, a Relative Virtual Address measured in bytes from the start of the file, so a reader seeks by adding the RVA to the file base. Flags holds the MINIDUMP_TYPE bitmask recording what the dump writer chose to include, from a bare stack-only dump to one with full process memory.

The stream directory and location descriptors

A minidump is organised as a set of independent streams, and the directory at StreamDirectoryRva is an array of MINIDUMP_DIRECTORY entries, one per stream, that acts as the file’s table of contents.

MINIDUMP_DIRECTORY
  StreamType   uint32   what kind of stream this is (see below)
  Location     MINIDUMP_LOCATION_DESCRIPTOR
     DataSize  uint32   length of the stream in bytes
     Rva       uint32   file offset where the stream data begins

Each entry names a StreamType and gives a location descriptor: a size and an RVA. That indirection is why a parser never scans linearly for data. It reads the header, jumps to the directory, and for each stream it wants (say the module list) it finds the matching entry and seeks straight to that stream’s RVA. It also means a dump can carry only the streams a given MINIDUMP_TYPE requested, and a reader tolerates whatever is present.

The core streams: threads, modules, exception, system info

A handful of stream types carry the information that actually explains a crash. Each is a counted array: a 32-bit count followed by that many fixed-size records.

StreamStreamTypeWhat it holds
ThreadListStream3Each thread: its ID, a MINIDUMP_MEMORY_DESCRIPTOR for its stack, and a CONTEXT record of CPU registers
ModuleListStream4Each loaded EXE/DLL: base address, size, timestamp and version, used to match symbols
ExceptionStream6The exception code and faulting address, plus the context of the thread that raised it
SystemInfoStream7OS version, CPU architecture, processor count
Memory64ListStream9Bulk memory regions (full-memory dumps), stored in one contiguous run after the list

The ThreadListStream is central: for every thread it stores an RVA to the thread’s saved stack memory and a CONTEXT structure holding the register file (the exact CONTEXT layout depends on the CPU architecture named in SystemInfo). The ModuleListStream records each loaded module’s base address and version so the debugger can line up the right symbols; a stack address only becomes a function name once it is resolved against the module that owns that address range. The ExceptionStream names the exception code, for example 0xC0000005 for an access violation, and the address that faulted. Together these let a debugger walk the faulting stack: it takes the thread’s CONTEXT, reads the saved stack memory, and unwinds frame by frame.

Symbols, and why a minidump needs PDBs to be readable

A minidump on its own gives addresses, not answers. The stack it stores is a list of return addresses into module memory; turning module+0x1a2f into ParseConfig() at a specific source line requires the matching PDB symbol file and the same module binary the crash used. This is why the ModuleList records exact versions and timestamps: the debugger uses them to fetch the correct symbols, often from a symbol server.

Two tools do the reconstruction. In WinDbg you open the dump and run !analyze -v, which identifies the probable faulting module and prints the annotated stack. Visual Studio opens an .mdmp directly and, with the project’s source and PDBs, drops you at the faulting line. For a Blue Screen minidump in C:\Windows\Minidump, lightweight utilities like NirSoft BlueScreenView or WhoCrashed show the likely faulting driver in a table without any debugger knowledge. Crash-reporting frameworks such as Google Breakpad and Crashpad emit this same minidump format from non-Microsoft toolchains, which is why the format turns up well beyond native Windows apps.

Minidump versus full and kernel dumps

The word “minidump” describes the compactness, not one fixed size. The MINIDUMP_TYPE flags in the header let a writer include anything from just the faulting stack (MiniDumpNormal, a few dozen kilobytes) to the entire process address space (MiniDumpWithFullMemory, potentially gigabytes, stored via the Memory64 stream). All of these still carry the MDMP signature and the same header-plus-directory structure.

A kernel Blue Screen dump is different. A full MEMORY.DMP written by the Windows kernel does not use the MDMP signature; it begins with PAGEDUMP or PAGEDU64 and has its own layout, even though it shares the .dmp extension and is analyzed with the same tools. The small kernel minidumps Windows drops in C:\Windows\Minidump after a crash are the minidump form and open in WinDbg the same way an application dump does.

Privacy: what a minidump can leak

A minidump cannot execute; it is inert data, so opening one is safe from a code-execution standpoint. The real concern is privacy. Because a dump captures live process memory, it can contain fragments of whatever the program was holding at the crash: file paths, user names, in-memory passwords or authentication tokens, decrypted document contents, or clipboard data. A full-memory dump captures far more than a stack-only one. Treat a minidump from a sensitive application as sensitive data, and share it only with a developer or vendor you trust. Be wary of files named like something.mdmp.exe or of “dump reader” downloads bundled with adware; open real dumps only in genuine Microsoft tools (WinDbg, Visual Studio) or reputable utilities.

FAQ

Why does a minidump address everything by RVA instead of file offset?

An RVA is a byte offset from the start of the file, so it functions as a file offset here, but the term reflects the format’s design: the header, the stream directory and every location descriptor use RVAs so a reader can jump directly to any stream or record without walking the file. It keeps the structure a set of independently locatable pieces rather than a fixed linear layout, which is what lets a dump include only the streams that were requested.

Can I delete .mdmp files, and can I convert one?

Yes to deleting: minidumps are diagnostic crash files, not part of your data or the OS, and Disk Cleanup even offers to remove system error dumps. Keep one only if a developer asked for it. You cannot meaningfully convert a minidump; the only useful output is a text crash report generated by a debugger, for example by saving WinDbg’s !analyze -v results.

References