How to create a kernel dump using WinDbg

Question

I'm debugging a kernel-mode device driver for Windows, using WinDbg. Is it possible to create a minidump on-demand?

I mean, one of my breakpoints is hit, the system is stopped. I want to create a minidump (let's say stack only). Is there a WinDbg keyword for this?

Thanks in advance

Answer 1

You can write a minidump like so when it hits your breakpoint:

bp myDLL!myFunc ".dump /ma c:\myDump.dmp;g"

This will add a breakpoint to your function and execute the commands in the quotation marks, this will write a minidump with most flags and then continue.

See here for more info on .dump and here on bp syntax.

To dump the complete memory in user or kernel mode:

.dump /f

but /ma switch actually puts more information in for user-mode.

If you get the error:

Unable to create file 'c:\myDump.dmp' - Win32 error 0n5
    "Access is denied."

try writing the file to the c:\users\public\ directory.

.dump /f c:\users\public\myDump.dmp

Answer 2

Note that .dump cannot create a Kernel Memory Dump, only Complete or Small Memory dumps (/f or /m). To get a kernel memory dump, you need to use the Control Panel to enable writing of dump files, then use .crash in the debugger to trigger a crash which will cause a dump file to be written.

See the windbg help for .crash for more details on how to use it, including a link to "Creating a Kernel-Mode Dump File".