This is a mirror of official site: http://jasper-net.blogspot.com/

Basic analysis of an unmanaged memory dump (C++)

| Wednesday, April 7, 2010
Properly collecting a User Mode memory dump is only the first step in uncovering the cause of a crash or hang.  The remainder of this post will assume that you have already configured WinDBG correctly and captured a memory dump using the techniques outlined in previous posts.

For the purpose of this posting we will assume the following scenario.

You are a software vendor that has written an automated banking machine application.  Several times a day the kiosk is restarted by the customer because the application has crashed.  In an effort to identify the cause of the crash, which happens when you are not there, you have used ADPLUS to collect a User Mode memory dump.  The memory dump has been copied onto your machine and you are ready to start debugging.

Open the dump file by selecting the “Open Crash Dump…” option found under the “File” menu within WinDBG.  Browse to the appropriate memory dump file and click the “Open” button.  After a few moments WinDBG will return control to you and a prompt should be seen that is similar to “0:000>” (ProcessId:ThreadId>) as seen in the bottom centre of the image below.  

Read more: Practical Development

Posted via email from jasper22's posterous

0 comments: