如何使用C ++读取Windows BSOD生成的memory.dmp

Question

I need to read information, code, flags, address, etc from a memory.dmp file generated from a windows BSOD through C++. The basic idea is that status info can be requested from a remote site and one of the requested pieces of information is some basic info from the last BSOD that occured on the machine thus I need to open the kernel/memory dump file through C++ (Im using MSVC 2005).

Answer 1

Start here , then realize using scripted commands in WinDBG is much easier.

Note: you only need WinDBG on the analysis machine, not the crashing one. You retrieve the minidump and analyse it externally. The only difficulty you will have is getting the right symbols - for Windows, Microsoft makes them available via their symbol servers, but applications that caused the crash may not supply the right symbols you need. IF they are you own applications causing the crash, get a symbol server and use it.

Answer 2

I would configure Windows to create small kernel memory dumps which will include the parameter of the bugcheck you are after.

On XP it was 64KB on my Win8.1 x64 it is 256KB. These files compress well. You should be able to get away with a zip file of 10-60KB size depending on the bitness of the OS. If bandwidth is of of utmost importance to you, you can use 7z which compresses about 50% better than the plain zip algo at the expense of much longer compression times (5-6 longer) but for such small files the CPU time difference should be irrelevant.

If you do not want your users to configure dump reporting you need to set the DWORD

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl

to 3 for a small kernel dump programatically.

For an explanation of the values see http://technet.microsoft.com/en-us/library/cc976050.aspx

• 0 Debugging information is not written to a file.
• 1 Complete crash dump is written to a file.
• 2 Kernel memory dump is written to a file.
• 3 Small memory dump is written to a file.

You will then get by default a small kernel dump in %SystemRoot%\\MEMORY.DMP.