When are memory dump files exactly created?

Question

I have configured my windows 7 to create mini dump files on crashes but when my application crashed, no dump file was created. The search for answer left me rather confused as to when are dump files created, when windows crashes or my application crashes?

In my case, I am looking for dump file when my application crashes. I receive a typical crash dialog that states:

TheApp Application has stopped working

Windows can check online for a solution to the problem

-> Check online for a solution and close the program

-> Close the program

-> Debug the program

So can I generate dump file for my application when it crashes? I can't produce this bug on development machine so I want to walk back from dump file. Is there any other option to trace the source of bug (to source code)?

Answer 1

First of all, there are different places to configure a "create a minidump on crash" setting, which are totally different.

1. You can configure Windows to create a kernel dump file when Windows crashes, i.e. when a Bluescreen of death (BSOD) occurs. This is done in the following screen on Windows 7:

   

2. You can configure Windows to create a user mode dump file when an application crashes, i.e. instead of the "Windows Error Reporting" dialog which would normally appear. To do so, and you know that in advance, then configure a Registry key called LocalDumps (MSDN). By default, dumps will be created below %LOCALAPPDATA%\CrashDumps and they will have the naming scheme app.exe.<PID>.dmp.

   

3. For the sake of completeness, there might be other triggers. The only sure way to tell is: when the method MiniDumpWriteDump (MSDN) is called.

I'm quite sure that you want option 2 of the above. If you have trouble with it, see whether all the conditions for LocalDump are fulfilled.

The answer given by @antlersoft does not work, for the reasons I have posted in my blog: at the time the dialog is shown, Windows has triggered a breakpoint to stop the application and it has injected a callstack of Windows Error Reporting. All in all, not a good starting point for debugging.

What would work is:

1. attach a debugger of your choice
2. press "Go" in the debugger
3. press the "Debug" button of the WER dialog
4. confirm the warning about the debugger which is already attached
5. click "No" when asked to start debugging using the selected debugger

Using Task Manager to create a crash dump is not recommended, since it will not consider the bitness of the application, which may cause trouble later. See ways to create good and useful crash dumps.

Answer 2

Minidump is created when Windows crashes. It's not intended to application crash.

If you want to debug crashes of your application, you may attach it to a debugger after it is started. Clicking on the "Debug" button when application crashes do the same. You can use the debugger of MS Visual Studio to do that, for example.

See this page for help on attaching a process to MS Visual Studio debugger: https://msdn.microsoft.com/en-us/library/3s68z0b3.aspx

EDIT: following text removed, as this may not work as expected (comment from Thomas)

You can also create a dump file from task manager, however you will still need a debugger to analyze it and, actually I am not sure you will be able to get the dump file at the point application crashes. The best way, if you can, is to debug the process on the target machine by attaching it to debugger either after it is started or when crash occurs.