recovering a process dump from a memory dump with WinDbg

Question

I have a crash dump (memory.dmp), and I want to extract process (calc.exe) from it. I tried:

!process 0 0 calc.exe
PROCESS ffffb501f8c23580 <-- this is the address
    SessionId: 0  Cid: 035c    Peb: 481e33000  ParentCid: 02c4
    DirBase: 00f10002  ObjectTable: ffff938242cfc680  HandleCount: 1132.
    Image: calc.exe

.process /r /p <address>
Process ffffb501`f8c23580 has invalid page directories

So I tried to extract the process memory dump myself.

!process 0 17 calc.exe
PROCESS ffffb501f8c23580
    SessionId: 0  Cid: 035c    Peb: 481e33000  ParentCid: 02c4
    DirBase: 00f10002  ObjectTable: ffff938242cfc680  HandleCount: 1132.
    Image: calc.exe
    VadRoot ffffb501f8c23490 Vads 143 Clone 0 Private 1372. Modified 441. Locked 6.
    DeviceMap ffff938242818d50
    Token                             ffff93824b238360
    ElapsedTime                       01:09:04.412
    UserTime                          00:00:00.343
    KernelTime                        00:00:00.234
    QuotaPoolUsage[PagedPool]         148080
    QuotaPoolUsage[NonPagedPool]      24344
    Working Set Sizes (now,min,max)  (3997, 50, 345) (15988KB, 200KB, 1380KB)
    PeakWorkingSetSize                3945
    VirtualSize                       2097247 Mb <--- is this normal?
    PeakVirtualSize                   2097249 Mb
    PageFaultCount                    6322
    MemoryPriority                    BACKGROUND
    BasePriority                      9
    CommitCharge                      1532

What I intended to do is to just dump the memory at the address ffffb501f8c23580 for the size of the process.

However I notice that I get a virtual size of 2gb? Is there another way to extract this process dump from the crash dump? If so what's the the correct process to do this?

Answer 1

As I Commented the Address You are pointing to is not the start of process
it is the address of EPROCESS block for the process

kd> ? @$proc
Evaluate expression: -2063161104 = 8506a8f0

kd> !process 0 0 calc.exe
PROCESS 8506a8f0  SessionId: 1  Cid: 0ba4    Peb: 7ffdf000  ParentCid: 079c
    DirBase: 7e5b96a0  ObjectTable: bf8038b8  HandleCount:  75.
    Image: calc.exe

kd> .shell -ci "?? @$proc" head -n4
struct _EPROCESS * 0x8506a8f0
   +0x000 Pcb              : _KPROCESS
   +0x098 ProcessLock      : _EX_PUSH_LOCK
   +0x0a0 CreateTime       : _LARGE_INTEGER 0x01d81de1`f57a8fda
.shell: Process exited
kd>

the process module is mapped into the virtual address space of the process these spaces are available in the VAD or Virtual Address Descriptor

the memory of such space may or may not be available in the dump
most modules have init sections that are discarded once the loader has done its job
those memory spaces may not be available in the dump

in an x86 (32 bit process ) the user mode va normally ranged from 0 to 0x7fffffff (2gb)
in x64 it is 2 TB see link

from your query I think you want to dump a module and not process

process is a collection of threads

module is a file that is mapped in a certain area in the virtual address space of the process with appropriate read , write or execute permissions.

the running threads then read & write data or execute code as the case may be from those mapped spaces

if you need to know where a module (file calc.exe ) is loaded in the virtual address space of process (process calc.exe) you can use lm (loaded module command) or !vad (address as expression ) commands then use dd . dq db to view and .writemem to write to a file

the demo below is from a live system you may encounter page does not exist if you try to write not existent pages from dump

0: kd> ? @$proc
Evaluate expression: -53307480042816 = ffffcf84`629692c0

0: kd> ? calculator
Evaluate expression: 140698911440896 = 00007ff7`04a30000

0: kd> lm m calculator
start             end                 module name
00007ff7`04a30000 00007ff7`04e1f000   Calculator   (deferred)


0: kd> db 00007ff7`04a30000 l20
00007ff7`04a30000  4d 5a 90 00 03 00 00 00-04 00 00 00 ff ff 00 00  MZ..............
00007ff7`04a30010  b8 00 00 00 00 00 00 00-40 00 00 00 00 00 00 00  ........@.......


0: kd> !dh 00007ff7`04a30000

File Type: EXECUTABLE IMAGE

SECTION HEADER #1
   .text name
  211CDB virtual size
    1000 virtual address
  211E00 size of raw data  and so on output truncated for brevitey 
 
 0: kd> .writemem c:\foo.bin 00007ff7`04a30000  l40
Writing 40 bytes.
0: kd> .shell -ci "$$" xxd c:\foo.bin
<.shell waiting 10 second(s) for process>
00000000: 4d5a 9000 0300 0000 0400 0000 ffff 0000  MZ..............
00000010: b800 0000 0000 0000 4000 0000 0000 0000  ........@.......
00000020: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000030: 0000 0000 0000 0000 0000 0000 f800 0000  ................
.shell: Process exited
0: kd>