Memory Dump Analysis using Excel
Friday, November 9th, 2007Some WinDbg commands output data in tabular format so it is possible to save their output to a text file, import it to Excel and do sorting, filtering, and graph visualization, etc. Some commands from WinDbg include:
!stacks 1
Lists all threads with Ticks column so you can sort and filter threads that had been waiting no more than 100 ticks, for
example.
!irpfind
Here we can create various histograms, for example, IRP distribution based on [Driver] column.
I’ll show more examples later but now the graph depicting thread distribution in PID - TID coordinates on a busy multiprocessor
system with 25 user sessions and more than 3,000 threads:
WinDbg scripts offer possibility to output various tabulated data via .printf:
0:000> .printf "a\tb\tc"
a b c
- Dmitry Vostokov @ DumpAnalysis.org -