Comments on: Where did the crash dump come from? (Part 2) https://www.dumpanalysis.org/blog/index.php/2009/01/08/where-did-the-crash-dump-come-from-part-2/ Structural and Behavioral Patterns for Software Diagnostics, Forensics and Prognostics Wed, 06 May 2026 20:15:49 +0000 http://wordpress.org/?v=2.3.3 By: Dmitry Vostokov https://www.dumpanalysis.org/blog/index.php/2009/01/08/where-did-the-crash-dump-come-from-part-2/#comment-61858 Dmitry Vostokov Thu, 08 Jan 2009 21:18:29 +0000 https://www.dumpanalysis.org/blog/index.php/2009/01/08/where-did-the-crash-dump-come-from-part-2/#comment-61858 Cool! Thanks for this tip! Cool! Thanks for this tip!

]]> By: Sean Wheeler https://www.dumpanalysis.org/blog/index.php/2009/01/08/where-did-the-crash-dump-come-from-part-2/#comment-61848 Sean Wheeler Thu, 08 Jan 2009 19:28:48 +0000 https://www.dumpanalysis.org/blog/index.php/2009/01/08/where-did-the-crash-dump-come-from-part-2/#comment-61848 There is another trick you can use with FINDSTR to find unicode strings. If you use periods to separate the letters then findstr will find the unicode string. For example: findstr C.O.M.P.U.T.E.R.N.A.M.E memory.dmp Example output will look something like this: C.o.m.m.o.n.P.r.o.g.r.a.m.F.i.l.e.s.=.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.C.o.m.m.o.n. .F.i.l.e.s...C.O.M.P.U.T.E.R.N.A.M.E.=.H.O.M.E.-.P.C...C.o.m.S.p.e.c.=.C.:.\.W.I.N.N.T.\.s.y.s.t.e.m.3.2.\.c.m.d...e.x.e...N.U.M.B.E.R._.O.F._.P.R.O.C.E.S.S.O.R.S.=.1...O.S.=.W.i.n.d.o.w.s._.N.T. There is another trick you can use with FINDSTR to find unicode strings. If you use periods to separate the letters then findstr will find the unicode string.

For example:

findstr C.O.M.P.U.T.E.R.N.A.M.E memory.dmp

Example output will look something like this:

C.o.m.m.o.n.P.r.o.g.r.a.m.F.i.l.e.s.=.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.C.o.m.m.o.n. .F.i.l.e.s…C.O.M.P.U.T.E.R.N.A.M.E.=.H.O.M.E.-.P.C…C.o.m.S.p.e.c.=.C.:.\.W.I.N.N.T.\.s.y.s.t.e.m.3.2.\.c.m.d…e.x.e…N.U.M.B.E.R._.O.F._.P.R.O.C.E.S.S.O.R.S.=.1…O.S.=.W.i.n.d.o.w.s._.N.T.

]]>