Grabbing a dump file of another process via MiniDumpWriteDump

I was debugging a particular audio problem and I needed a process dump with full memory.

I used an internal gather-dumps tool and asked it to give me a bunch of dumps of the problem with full memory… and it gave me some dumps without full memory.

This told me that either the gather-dumps tool was broken, or MiniDumpWriteDump was broken, or perhaps both were working fine and my debugger was lying to me about the full-memory-ness of the dumps I was looking at.

To help narrow the problem down, I created a tool that is a very simple wrapper around MiniDumpWriteDump. This grabbed full memory dumps just fine, so I turned my attention toward the internal gather-dumps tool.

Usage:

>minidumpwritedump.exe
minidumpwritedump.exe [--help | -? | /?]
minidumpwritedump.exe --processId <processId> --dumpType <dumpType> --fileName <fileName>

See https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/nf-minidumpapiset-minidumpwritedump

EDIT 2020-06-30: added a PowerShell script to translate a MINIDUMP_TYPE number into a human-readable set of values

Usage:

.\minidump_type.ps1 -minidump_type 482707
MiniDumpWithDataSegs, MiniDumpWithFullMemory, MiniDumpScanMemory, MiniDumpFilterModulePaths, MiniDumpWithProcessThreadData, MiniDumpWithoutOptionalData, MiniDumpWithFullMemoryInfo, MiniDumpWithThreadInfo, MiniDumpWithoutAuxiliaryState, MiniDumpWithPrivateWriteCopyMemory, MiniDumpIgnoreInaccessibleMemory, MiniDumpWithTokenInformation

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s