Skip to main content
3 events
when toggle format what by license comment
Mar 21, 2014 at 8:46 comment added blabb but erasing peb like this will render the dump corrupt and will not let windbg read the dump as it relies on certain flags that indicate the presence or absence of peb
Mar 21, 2014 at 8:38 comment added blabb yes that should work you can use this expression in one line to create a dump thus f @$peb L?@@c++(sizeof(ntdll!_peb)) 0 ; .dump /marR /u c:\foo.dmp but iirc this will still have your utc (and possibly name of the region :) in time date stamp)
Mar 21, 2014 at 7:36 history answered Thomas Weller CC BY-SA 3.0