Kernel
Mode to User Mode Process Dump Extraction Utility (Phase 3)
Last Updated: 12/25/99
This document describes a utility for extracting information from a kernel mode crash dump file about the processes that existed at the time of the crash, and generating user mode process dump files for these processes. There are some limitations depending on what is actually contained in the crash dump file; paged-out pages can contain critical information such as thread contexts or module lists. In these cases the user mode process dump file(s) generated may not be complete. To help overcome these limitations, a facility is provided to allow the user to supply page files from the crashed system. This is mostly a forward-looking architectural infrastructure, as methods for obtaining such page files are currently ill-defined and proprietary to certain of the project participants.
The utility is in the form of genedump.exe. Separate versions exist for operating on crash dump files from NT4 systems and Windows 2000 systems.
Table of Contents Ý
Invoking genedump.exe with no arguments shows usage.
genedump [-l | [ProcSpec [-o DumpFile]]
[-p PageFile1,PageFile2,...] [-y SymPath] [-z CrashFile]
-l — displays the list of processes in the crash dump file (i.e., the processes that existed on the system at the time it crashed) and their process IDs.
ProcSpec — supplies a process ID, as either a decimal or 0x-prefixed hex number.
-o DumpFile — supplies the name of the dump file to be created. This can be any legal Win32 path specification. If not specified, the dump file is generated in the current directory using a name based on the image file name of the process whose crash dump file is being created (i.e., the process specified by ProcSpec).
-p PageFile — supplies pagefiles (win32 path specifications). If multiple PageFiles are specified, they must be specified in order. I.e., if you have the first pagefile and the third pagefile, specify (for example) -p pagefile1.sys,,pagefile3.sys. See note.
-y SymPath — supplies the symbol search path. Multiple paths can be supplied by separating them with semicolons.
-z CrashFile — supplies the win32 path specification of a kernel mode crash dump file from which a list of processes is to be displayed or a user mode crash dump file generated.
Table of Contents Ý
A list of process names and process IDs for the processes that were running at the time the system crashed (in other words, the processes that are “inside” a given kernel mode crash dump file) can be displayed by specifying the -l command line parameter. The -l command line option requires that both -y and –z also be specified.
C:\>genedump.exe -l -y C:\Symbols -z
C:\memory.dmp
User Dump File Extractor (Version 1.0)
Copyright (c) 1999 Microsoft Corp. All rights
reserved.
132
smss.exe
160
csrss.exe
180
winlogon.exe
208
services.exe
228
lsass.exe
392
svchost.exe
424
spoolsv.exe
476
svchost.exe
108
NPSSVC.EXE
616
regsvc.exe
632
mstask.exe
700
userdump.exe
732
explorer.exe
776
conime.exe
328
internat.exe
860
navapw32.exe
864
qshelf98.exe
912
navapsvc.exe
880
alertsvc.exe
636
MDM.EXE
1248
taskmgr.exe
1412
os2srv.exe
1296
os2ss.exe
1116
imejpmgr.exe
1212
specimen.exe
996
crash.exe
112
cmd.exe
1408 sample.exe
Table of Contents Ý
A user mode crash dump file for any win32 process in a given kernel mode crash dump file can be generated by specifying a process ID on the command line. This mode of operation requires that both -y and -z also be specified. The –o parameter is optional. Status messages indicate progress and should be carefully examined as there are cases where the generated user mode crash dump file will be incomplete.
Assuming that crash.exe had a process ID of 996, the following example generates a user mode crash dump file from memory.dmp for crash.exe to D:\users\crash.dmp.
C:\>genedump.exe 996 -y
C:\Symbols -z C:\memory.dmp -o D:\users\crash.dmp
User Dump File Extractor (Version 1.0)
Copyright (c) 1999 Microsoft Corp. All rights
reserved.
Generating a Userdump File For crash.exe.
===> D:\users\crash.dmp
-
Memory Maps : 81 (regions)
-
Thread Contexts :
2 (threads)
-
Thread States : 2 (threads)
-
Process Modules : 20 (modules)
-
Pages : 2706 (pages)
Successfully Completed.
Table of Contents Ý