What is the best way to dump user space process by pid debugging the kernel with windbg? I'm able to attach to the process from user-space with windbg and generate crash by .dump, but how would I do it from the kernel for only a single process and not generate crash dump of the whole kernel?
1
-
Is there any particular reason / use case you'd like to do it this way and not via a user mode session?– Thomas WellerCommented Dec 13, 2013 at 9:30
Add a comment
|
2 Answers
You should try using .writemem
For example:
.writemem c:\www.exe 0x400000 0xE3000
where 0x400000 is the main executable's image base.
Extract it from pEPROCESS->SectionBaseAddress, 0xE3000 is SizeOfImage as in PE header, and c:\www.exe is the output file.
-
I would like to get all the associated memory pages (mostly interested in heap) of the process. Doing a writemem for each one of them is a lot of work so would prefer to trigger crash dump and get everything in one file automatically if possible.– gljivaCommented Jun 27, 2013 at 8:55
Dumping a process in user mode (.dump /ma) will dump all of its virtual memory. This includes memory which is currently paged to disk. It will be paged in during the dump process.
Kernel debugging is close to debugging physical memory only. So even if you manage to dump all physical memory of the process, you only have the part which is called "WorkingSet". It would not be a complete dump, especially you couldn't use it for debugging .NET.
So, finally, even if it's possible somehow, you'll not get the same results.
