Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

MiniDumpWriteDump another process

I'm trying to create a service with the goal of monitor the applications created by my company.

When the app gets the state of No responding, the service have to generate a a dump with MiniDumpWriteDump.

The problem is: when using HANDLE of another process, the MiniDumpWriteDump doesn't work. The .dmp file stays empty.

GetLastError returns 0xD0000008 (3489660936)

That function is to get HANDLE by pid:

void CDumpGenerator::FindAndSetHandle()
{
    HANDLE hProcessSnap;
    HANDLE hProcess;
    PROCESSENTRY32 pe32;

    EnableDebugPriv();

    hProcessSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
    if (hProcessSnap == INVALID_HANDLE_VALUE)
        return;

    pe32.dwSize = sizeof(PROCESSENTRY32);

    if (!Process32First(hProcessSnap, &pe32))
    {
        CloseHandle(hProcessSnap);

        return;
    }

    do
    {
        hProcess = OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_READ | PROCESS_DUP_HANDLE, FALSE, pe32.th32ProcessID);

        if (hProcess != NULL)
            CloseHandle(hProcess);

        if (pe32.th32ProcessID == this->pid)
        {
            this->processHandle = hProcess;

            break;
        }
    } while (Process32Next(hProcessSnap, &pe32));

    CloseHandle(hProcessSnap);
}

EnableDebugPriv:

void EnableDebugPriv()
{
    HANDLE hToken;
    LUID luid;
    TOKEN_PRIVILEGES tkp;

    OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &hToken);

    LookupPrivilegeValue(NULL, SE_DEBUG_NAME, &luid);

    tkp.PrivilegeCount = 1;
    tkp.Privileges[0].Luid = luid;
    tkp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;

    AdjustTokenPrivileges(hToken, false, &tkp, sizeof(tkp), NULL, NULL);

    CloseHandle(hToken);
}

And i'm calling MiniDumpWriteDump this way:

auto dumped = MiniDumpWriteDump(
    this->processHandle,
    this->pid,
    hFile,
    MINIDUMP_TYPE(MiniDumpNormal | MiniDumpWithThreadInfo |  MiniDumpWithProcessThreadData | MiniDumpWithFullMemoryInfo),
    nullptr,
    &userStream,
    nullptr);

When I change this->processHandle to GetCurrentProcess() works fine.

Handle being set:

enter image description here

Here is the GetLastError()

enter image description here

like image 850
Kevin Kouketsu Avatar asked Aug 10 '26 13:08

Kevin Kouketsu


1 Answers

I just solved the problem removing this part

hProcess = OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_READ | PROCESS_DUP_HANDLE, FALSE, pe32.th32ProcessID);

// This close handle
if (hProcess != NULL)
    CloseHandle(hProcess);

It's a simple thing that went unseen. So we need close handle on other part of code like destructor or anything else.

like image 75
Kevin Kouketsu Avatar answered Aug 12 '26 03:08

Kevin Kouketsu