使用Windbg生成dump文件

h Adds data about the handles associated with the target application to the minidump.
u Adds unloaded module information to the minidump. This is available only in Windows Server 2003 and later versions of Windows.
选项(3)：/mFhutwd
命令行示例：.dump /mFhutwd C:\dumps\myapp.dmp
注解：带有数据段、非共享的读/写内存页和其他有用的信息的minidump。包含了通过minidump能够得到的最多的信息。是一种折中方案。
--------------------------------------------------------------------------------
我们所说的crash或者exception包括各种各样的情况，比如系统某个进程占用大量资源，某个进程low performance，某个程序crash等等。为了获得发生crash或者exception的process的context, 我们必须得到发生exception的时候，该process的context。那么可以给该process进行捕捉一个snapshot。捕捉发生exception时刻的snapshot所用的方法就是dump当时该process的内存。
i Adds secondary memory to the minidump. Secondary memory is any memory referenced by a pointer on the stack or backing store, plus a small region surrounding this address.
/m[MiniOptions]
Creates a small memory dump (in kernel mode) or a minidump (in user mode). If neither /f nor /m is specified, /m is the default.
In user mode, /m can be followed with additional MiniOptions specifying extra data that to be included in the dump. If no MiniOptions are included, the dump will include module, thread, and stack information, but no additional data. You can add any of the following MiniOptions to change the contents of the dump file; they are case-sensitive.
t Adds additional thread information to the minidump. This includes thread times, which can be displayed by using the !runaway extension or the .ttime (Display Thread Times) command when debugging the minidump.
使用Windbg生成dump文件WinDBG
2010-10-21 23:19:50 阅读145 评论0 字号：大中小 订阅
Windbg生成dump文件的方法：
程序崩溃（crash）的时候， 为了以后能够调试分析问题， 可以使用WinDBG要把当时程序内存空间数据都保存下来，生成的文件称为dump 文件。 步骤：
f Adds full memory data to the minidump. All accessible committed pages owned by the target application will be included.
F Adds all basic memory information to the minidump. This adds a stream to the minidump that contains all basic memory information, not just information about valid memory. This allows the debugger to reconstruct the complete virtual memory layout of the process when the minidump is being debugged.
1） 打开WinDBG并将之Attach 到crash的程序进程
2） 输入产生dump 文件的命令
WinDBG产生dump 文件的命令是 .dump ，可以选择不同的参数来生成不同类型的dump文件。
选项(1)： /m
命令行示例：.dump /m C:\dumps\myapp.dmp
R Deletes the full module paths from the minidump. Only the module names will be included. This is a useful option if you want to protect the privacy of the user's directory structure.
2.dump内存的方法
这里介绍一种dump内存的方法，就是windbg中的.dump。当程序发生异常时，我们可以通过该方法snapshot该process在发生exception的时候的context。
具体做法就是：
当program发生exception的时候，或者发生之前，我们可以将windbg attach to a specific process in which en exception will occur. 然后在windbg command window中，type g or press F5 to let the program execute.如果不出意外的话，会出现exception,然后我们我们可以用.dump command来capture the snapshot。the following section is the usage about command .dump.
p Adds process environment block (PEB) and thread environment block (TEB) data to the minidump. This can be useful if you need access to Windows system information regarding the application's processes and threads.
Options
Represents one or more of the following options
/o
Overwrites an existing dump file with the same name. If this is option not used and the there is a file with the same file name, the dump file is not written.
r Deletes from the minidump those portions of the stack and store memory that are not useful for recreating the stack trace. Local variables and other data type values are deleted as well. This option does not make the minidump smaller (because these memory sections are simply zeroed), but it is useful if you want to protect the privacy of other applications.
/f
(Kernel mode:) Creates a complete memory dump.
(User mode:) Creates a full user-mode dump. Despite their names, the largest minidump file actually contains more information than a full user-mode dump. For example, .dump /mf or .dump /ma creates a larger and more complete file than .dump /f. In user mode, .dump /m[MiniOptions] is always preferable to .dump /f.
w Adds all committed read-write private pages to the minidump.
d Adds all read-write data segments within the executable image to the minidump.
c Adds code sections within images.
1.为什么需要dump 内存