4

What is the best way to dump user space process by pid debugging the kernel with windbg? I'm able to attach to the process from user-space with windbg and generate crash by .dump, but how would I do it from the kernel for only a single process and not generate crash dump of the whole kernel?

  • Is there any particular reason / use case you'd like to do it this way and not via a user mode session? – Thomas Weller Dec 13 '13 at 9:30
2

You should try using .writemem

For example:

.writemem c:\www.exe 0x400000 0xE3000

where 0x400000 is the main executable's image base.

Extract it from pEPROCESS->SectionBaseAddress, 0xE3000 is SizeOfImage as in PE header, and c:\www.exe is the output file.

  • I would like to get all the associated memory pages (mostly interested in heap) of the process. Doing a writemem for each one of them is a lot of work so would prefer to trigger crash dump and get everything in one file automatically if possible. – gljiva Jun 27 '13 at 8:55
1

Dumping a process in user mode (.dump /ma) will dump all of its virtual memory. This includes memory which is currently paged to disk. It will be paged in during the dump process.

Kernel debugging is close to debugging physical memory only. So even if you manage to dump all physical memory of the process, you only have the part which is called "WorkingSet". It would not be a complete dump, especially you couldn't use it for debugging .NET.

So, finally, even if it's possible somehow, you'll not get the same results.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.