Windows dump file generation and analysis

First, generate dump file mode

1.1 Task Manager

After the program crashes, do not close the program, in the task Manager to find the process corresponding to the program. Create a dump file right-click.

A dump file is created in the default directory.

As you can see, this method only applies if the program crashes but does not immediately exit itself. This method is difficult to apply if the program fails to exit itself. However, we can add the following information in the registry to ensure that the system will save a dump file after the program crashes:

Found in the registry

Hkey_local_machine\software\microsoft\windows\windowserror Reporting\localdumps

Add items such as:

The meaning of the Dumptype Representative is:

0 = Create a custom dump
1 = Mini Dump
2 = Full Dump

As a result, once the program crashes, a dump file is generated under C:\CrashDump.

1.2WINDBG Crawl

After the program crashes, the program is not closed and the WinDbg is attached to the change process.

Execute command:. Dump–ma test.dmp, a test.dmp dump file is generated.

This article was reproduced in: 78739962

Windows dump file generation and analysis