Dumping Vista
Sunday, February 4th, 200732-bit Vista
If you need to dump a running 32-bit Vista system you can do it with Citrix SystemDump tool. You just need to run it with elevated administrator rights:
-
right click SystemDump.exe in appropriate Computer explorer folder and choose “Run as administrator”
-
if you use command line options run SystemDump.exe from elevated command prompt (Start -> All Programs -> Accessories, right click Command Prompt, and then select “Run as administrator”)
Here is a screenshot before dumping my Vista and WinDbg output from saved kernel dump:
Loading Dump File [C:\Windows\MEMORY.DMP]
Kernel Summary Dump File: Only kernel address space is available
Windows Vista Kernel Version 6000 UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 6000.16386.x86fre.vista_rtm.061101-2205
Kernel base = 0x81800000 PsLoadedModuleList = 0x81908ab0
Debug session time: Sat Jan 27 20:13:10.917 2007 (GMT+0)
System Uptime: 0 days 1:33:13.589
Loading Kernel Symbols
Loading User Symbols
Loading unloaded module list
BugCheck E2, {cccccccc, 83286f08, 1a, 0}
Probably caused by : SystemDump.sys
64-bit Vista
Currently in order to use 64-bit SystemDump you have to disable “Driver Signature Enforcement” by:
- F8 Advanced Boot Option
- command line tool BCDedit
- attaching an active kernel debugger
Then you need to run SystemDump64.exe as administrator.
- Dmitry Vostokov -