Kernel Mode to User Mode Process Dump Extraction Utility (Phase 3)

 

Last Updated: 12/25/99

 

 


1.     Introduction. 1

2.     Usage. 1

3.     Displaying a List of Processes. 1

4.     Generating a Crash Dump File for a User Mode Process. 2

 


1.      Introduction

This document describes a utility for extracting information from a kernel mode crash dump file about the processes that existed at the time of the crash, and generating user mode process dump files for these processes. There are some limitations depending on what is actually contained in the crash dump file; paged-out pages can contain critical information such as thread contexts or module lists. In these cases the user mode process dump file(s) generated may not be complete. To help overcome these limitations, a facility is provided to allow the user to supply page files from the crashed system. This is mostly a forward-looking architectural infrastructure, as methods for obtaining such page files are currently ill-defined and proprietary to certain of the project participants.

 

The utility is in the form of genedump.exe. Separate versions exist for operating on crash dump files from NT4 systems and Windows 2000 systems.

 

Table of Contents Ý

 

2.      Usage

Invoking genedump.exe with no arguments shows usage.

 

genedump [-l | [ProcSpec [-o DumpFile]]

           [-p PageFile1,PageFile2,...] [-y SymPath] [-z CrashFile]

 

-l — displays the list of processes in the crash dump file (i.e., the processes that existed on the system at the time it crashed) and their process IDs.

 

ProcSpec — supplies a process ID, as either a decimal or 0x-prefixed hex number.

 

-o DumpFile — supplies the name of the dump file to be created. This can be any legal Win32 path specification. If not specified, the dump file is generated in the current directory using a name based on the image file name of the process whose crash dump file is being created (i.e., the process specified by ProcSpec).

 

-p PageFile — supplies pagefiles (win32 path specifications). If multiple PageFiles are specified, they must be specified in order. I.e., if you have the first pagefile and the third pagefile, specify (for example) -p pagefile1.sys,,pagefile3.sys. See note.

 

-y SymPath — supplies the symbol search path. Multiple paths can be supplied by separating them with semicolons.

 

-z CrashFile — supplies the win32 path specification of a kernel mode crash dump file from which a list of processes is to be displayed or a user mode crash dump file generated.

 

Table of Contents Ý

 

3.      Displaying a List of Processes

A list of process names and process IDs for the processes that were running at the time the system crashed (in other words, the processes that are “inside” a given kernel mode crash dump file) can be displayed by specifying the -l command line parameter. The -l command line option requires that both -y and –z also be specified.

 

C:\>genedump.exe -l -y C:\Symbols -z C:\memory.dmp

User Dump File Extractor (Version 1.0)

Copyright (c) 1999 Microsoft Corp. All rights reserved.

 

   132 smss.exe

   160 csrss.exe

   180 winlogon.exe

   208 services.exe

   228 lsass.exe

   392 svchost.exe

   424 spoolsv.exe

   476 svchost.exe

   108 NPSSVC.EXE

   616 regsvc.exe

   632 mstask.exe

   700 userdump.exe

   732 explorer.exe

   776 conime.exe

   328 internat.exe

   860 navapw32.exe

   864 qshelf98.exe

   912 navapsvc.exe

   880 alertsvc.exe

   636 MDM.EXE

  1248 taskmgr.exe

  1412 os2srv.exe

  1296 os2ss.exe

  1116 imejpmgr.exe

  1212 specimen.exe

   996 crash.exe

   112 cmd.exe

1408 sample.exe

 

Table of Contents Ý

 

4.      Generating a Crash Dump File for a User Mode Process

A user mode crash dump file for any win32 process in a given kernel mode crash dump file can be generated by specifying a process ID on the command line. This mode of operation requires that both -y and -z also be specified. The –o parameter is optional. Status messages indicate progress and should be carefully examined as there are cases where the generated user mode crash dump file will be incomplete.

 

Assuming that crash.exe had a process ID of 996, the following example generates a user mode crash dump file from memory.dmp for crash.exe to D:\users\crash.dmp.

 

C:\>genedump.exe 996 -y C:\Symbols -z C:\memory.dmp -o D:\users\crash.dmp

User Dump File Extractor (Version 1.0)

Copyright (c) 1999 Microsoft Corp. All rights reserved.

 

Generating a Userdump File For crash.exe.

    ===> D:\users\crash.dmp

 

  - Memory Maps          :     81 (regions)

  - Thread Contexts      :      2 (threads)

  - Thread States        :      2 (threads)

  - Process Modules      :     20 (modules)

  - Pages                :   2706 (pages)

Successfully Completed.

 

Table of Contents Ý