How to create a kernel dump using WinDbg

kernel windbg minidump
valdo picture valdo · Nov 22, 2012 · Viewed 9.2k times · Source

I'm debugging a kernel-mode device driver for Windows, using WinDbg. Is it possible to create a minidump on-demand?

I mean, one of my breakpoints is hit, the system is stopped. I want to create a minidump (let's say stack only). Is there a WinDbg keyword for this?

Thanks in advance

Answer

EdChum picture EdChum · Nov 22, 2012

You can write a minidump like so when it hits your breakpoint:

bp myDLL!myFunc ".dump /ma c:\myDump.dmp;g"

This will add a breakpoint to your function and execute the commands in the quotation marks, this will write a minidump with most flags and then continue.

See here for more info on .dump and here on bp syntax.

To dump the complete memory in user or kernel mode:

.dump /f

but /ma switch actually puts more information in for user-mode.

If you get the error: 

Unable to create file 'c:\myDump.dmp' - Win32 error 0n5
    "Access is denied."

try writing the file to the c:\users\public\ directory.

.dump /f c:\users\public\myDump.dmp

Related questions

Kernel trace Windows 7 WinDbg

I'm getting no debug information when debugging en_windows_7_checked_build_dvd_x86_398742. I can't see even my own trace info (ATLTRACE). In opposite, Windows XP Checked works like a charm. I get "Bad QueryIdType:5" msg on debug session start …

Read More
How to turn off Windows kernel debugging at boot time?

I have a Vista 32 bit machine which I wanted to enable local kernel debugging on. In WinDbg I selected File/Kernel Debug and selected the Local tab and clicked ok. I got the following message. The system does not support …

Read More
What is an OS kernel ? How does it differ from an operating system?

I am not able to understand the difference between a kernel and an operating system. I do not see any difference between them. Is the kernel an operating system?

Read More