What is the best way to dump user space process by pid debugging the kernel with windbg? I'm able to attach to the process from user-space with windbg and generate crash by .dump, but how would I do it from the kernel for only a single process and not generate crash dump of the whole kernel?
You should try using
.writemem c:\www.exe 0x400000 0xE3000
0x400000 is the main executable's image base.
Extract it from
SizeOfImage as in PE header, and
c:\www.exe is the output file.
Dumping a process in user mode (.dump /ma) will dump all of its virtual memory. This includes memory which is currently paged to disk. It will be paged in during the dump process.
Kernel debugging is close to debugging physical memory only. So even if you manage to dump all physical memory of the process, you only have the part which is called "WorkingSet". It would not be a complete dump, especially you couldn't use it for debugging .NET.
So, finally, even if it's possible somehow, you'll not get the same results.