2
not sure what methodology you are looking for if the said gui is under some debugger
you can simply detour a patch
or if you are under the wndproc Thread of the gui You can use apis
(for example for checking the menu wordwrap in notepad use CheckMenuItem(); )
or use the oldest trick SendMessage From an external App a demo and src of the third method ...
2
It is possible. Take a minute to read the output from analyze. There's a few fields that will tell you what driver faulted like "FAULTING_MODULE", "IMAGE_NAME", and "MODULE_NAME".
It will give you the state of the registers as well and specifically what instruction that caused the crash so you'll see something like
driver + offset:
addresss: instruction
...
1
Actually, I think this should technically be possible, without having put too much thought into it. Freeze all threads, save thread context state for all of them, enumerate all of the memory used by the program and dump it alongside meta data.
A problem would be stuff like open handles (files, connected sockets etc.) but for programs within a limited scope ...
Only top voted, non community-wiki answers of a minimum length are eligible
