Archive for October 28th, 2006

Preview of DumpDepends tool

Saturday, October 28th, 2006

There are many cases where we need to dump several processes simultaneously and complete memory dump is not an option.
DumpDepends tool will dump processes and optionally package them into a CAB file. There are several options:

  • Dump all processes
  • Dump important services (Terminal, IMA, CTXXMLSS, Printing, Spooler, SVCHOST)
  • Dump all processes from the given session ID (additionally including children and important services if needed)
  • Dump an individual process (optionally including children and important services) 

The tool will use external process dumpers in noninvasive manner (NTSD by default or any other specified, like userdump.exe)
On x64 it will distinguish between 32-bit and 64-bit processes and dump them accordingly.
Command line option will also be available.

Later this tool will included in Dump Monitor Suite

Any comments and suggestions are welcome.

- Dmitry Vostokov-

Posted in Crash Dump Analysis, Tools | No Comments »

Dumping processes without breaking them

Saturday, October 28th, 2006

You can do it on any Windows system without installing any additional tools like Userdump or WinDbg. And your process won’t be interrupted while the dump is being saved and will continue to work. Use the following command:

ntsd -pvr -p 'PID' -c ".dump /ma /u process.dmp; q"

PID is a decimal process ID you can get from Task Manager, for example. 

Note: on x64 system to dump a 32-bit process (shown as *32 in Task Manager) you need to use NTSD from \Windows\SysWOW64 folder.

- Dmitry Vostokov -

Posted in Crash Dump Analysis, Tools | 2 Comments »