Windows DatabaseebooksStatistical Information

LWE10308 : Howto create a memory dump from an application in windows with windbg


You can use the windbg debugger to create a crash dump (memory dump) file from a process




You connect your debugger on a certain process or you start the executable via the debugger and break into the debugger. (via Ctrl-Break or via the menu of the debugger) Now you can dump a memory dump. e.g.

.dump /mfhp c:\temp\gooddump.dmp

There are quite a few options for the parameters. These previous command will create a usefull dump.

more parameters:

m  creates a minidump
a  Creates a minidump with all optional additions
f  Adds full memory data to the minidump. All accessible committed pages owned by the target application will be included.
F  Adds all basic memory information
h  Adds data about the handles associated with the target application to the minidump.
u  Adds unloaded module information to the minidump
t  Adds additional thread information to the minidump
i  Adds secondary memory to the minidump
p  Adds process environment block (PEB) and thread environment block (TEB) data to the minidump
w  Adds all committed read-write private pages to the minidump.  
d  Adds all read-write data segments within the executable image to the minidump.
c  Adds code sections within images.


The information provided in this document is intended for your information only. Lubby makes no claims to the validity of this information. Use of this information is at own risk!
Copyright © 2004-2011 Lubby (V3.0.10 Aug 2011)
Sponsored by Keskon.
Statistical information by Google Analytics