6

I want to publish a crash dump on the Internet for other people to learn from the dump. Usually I take dumps with .dump /ma which is fine.

However, I'm a bit concerned about personal data included in the dump and I'd like to remove it. The WinDbg help file specifies the r and R flags.

R (this part is clear for me):

Deletes the full module paths from the minidump. Only the module names will be included. This is a useful option if you want to protect the privacy of the user's directory structure.

r (I don't fully understand how that protects privacy of other applications):

Deletes from the minidump those portions of the stack and store memory that are not useful for recreating the stack trace. Local variables and other data type values are deleted as well. This option does not make the minidump smaller (because these memory sections are simply zeroed), but it is useful if you want to protect the privacy of other applications.

Which options should I use to re-dump to get a dump without personal information? Are there any other switches I should activate?

Assumptions:

  • it's a user mode dump
  • the application itself does not store any sensitive data, so it's basically ok to deliver full memory.

Update

I'm especially interested in removing the process environment block so that !peb does not show all the system information.

Improve this question
2
  • One thing that comes to mind and could potentially leak privacy information in a user dump is if you have applications communicating with each other. You could have application A receiving messages from application B and the stack would then contain the message data of application B.
    – Lieven Keersmaekers
    Commented Mar 18, 2014 at 6:38
  • 1
    Wouldn't it be an option to produce the dump within a vanilla VM, such that no personal data could possibly be contained?
    – 0xC0000022L ♦
    Commented Mar 21, 2014 at 11:34

2 Answers 2

Reset to default
2

do not use the a in /ma a means all info is dumped

for peb to be included use /p

a basic dump without pdb will be created by

C:\>cdb -c ".dump /mrR /u c:\foo.dmp;q" calc

0:000> cdb: Reading initial command '.dump /mrR /u c:\foo.dmp;q'
Creating c:\foo_0c84_2014-03-21_03-03-38-328_06fc.dmp - mini user dump
Dump successfully written
quit:

C:\>cdb -z foo_0bd8_2014-03-21_03-02-11-359_0548.dmp

7c90120e cc              int     3

0:000> !peb
PEB NULL...

0:000> q
quit:

C:\>
Improve this answer
2
  • I need more memory than just /m in many cases, so I use /ma. Perhaps I could reduce that to /mwdic, but usually I don't go into that detail of switches. Actually I'm fine with the memory, except the PEB. But even in a /mwdic, the PEB is included.
    – Thomas Weller
    Commented Mar 20, 2014 at 22:41
  • d and c will not put peb as those are related to executable images data and code w and i will add the memory range which resolves to peb and if the memory range is there in dump !peb command will work
    – blabb
    Commented Mar 20, 2014 at 23:27
2

It seems the following works for me. First, assume I have a full minidump, not necessarily created by WinDbg, but rather ProcDump, Task Manager or Process Explorer. In any case it will be equivalent to

.dump /ma <dumpname>

To remove the personal data, I first erase the PEB:

0:000> ? @$peb
Evaluate expression: 2130567168 = 7efde000

0:000> ?? sizeof(nt!_PEB)
unsigned int 0x248

0:000> f 7efde000 L248 0; *** Fill PEB with zeros

After this operation !peb is not useful any more:

0:000> !peb
PEB at 7efde000
    InheritedAddressSpace:    No
    ReadImageFileExecOptions: No
    BeingDebugged:            No
    ImageBaseAddress:         00000000
    Ldr                       00000000
    *** unable to read Ldr table at 00000000
    SubSystemData:     00000000
    ProcessHeap:       00000000
    ProcessParameters: 00000000
    *** unable to read process parameters

Next, write the empty PEB and remove module directory names using the r and R switch:

0:000> .dump /marR <dumpname>

Using SysInternals Strings on that dump does not reveal anything critical in the dump I used for testing.

Improve this answer
2
  • yes that should work you can use this expression in one line to create a dump thus f @$peb L?@@c++(sizeof(ntdll!_peb)) 0 ; .dump /marR /u c:\foo.dmp but iirc this will still have your utc (and possibly name of the region :) in time date stamp)
    – blabb
    Commented Mar 21, 2014 at 8:38
  • 1
    but erasing peb like this will render the dump corrupt and will not let windbg read the dump as it relies on certain flags that indicate the presence or absence of peb
    – blabb
    Commented Mar 21, 2014 at 8:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.