Working with WinDbg, save .dmp file

Question

I only started working with WinDbg and I saw video, where guy attach WinDbg to a process. Then he saved dump file as command ".dump /f C:\example\mydump.dmp". What is meaning with ".dump" and "/f" ? Thank you, sorry for my english.

Answer 1

Refer to the docs

This produces a user-mode or kernel-mode crash dump and with the switch /f will create a complete memory dump to that location.

However, personally I always use the flag /ma for user-mode dumps as this has more info (and produces a larger memory dump).

The dump is essentially memory (either the entire memory for kernel or your process for user mode) and depending on the flags you get more info such as state, handles and other info that help diagnose the problem.

For a more complete explanation you can read these links

• Kernel mode dumps
• user mode dumps