Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Extract process dump from full memory dump

I've reached a bug, but I was unable to create a process dump. I've created a full memory dump of system. How could I extract a process dump using it?
Windows.

like image 853
Jury Avatar asked Feb 28 '14 21:02

Jury


1 Answers

You cannot. In general, some of the memory segments that belong to your process could be paged out and not resident in physical memory. This means that with full kernel memory dump you are not guaranteed to reconstruct process address space.

In many cases you can extract useful information about process from kernel dump. However there are two limitations:

  1. Memory can be paged out, as I already mentioned.
  2. Many WinDbg extensions won't work with kernel dump. This includes SOS, so investigating managed processes are much more difficult from kernel space.
like image 119
seva titov Avatar answered Sep 28 '22 05:09

seva titov