How can I extract DLL file from memory dump?

windbg dump
Saar picture Saar · Oct 29, 2009 · Viewed 12k times · Source

I have a memory dump (unmanaged process) . How can I extract (using windbg) one of the dlls loaded into the process ? I mean actually saving the dll file into the disk

Answer

Steve picture Steve · Oct 29, 2009

You can use the sos.dll inside windbg directory.

First, load the sos.dll in windbg:

.load clr10\sos.dll

Then use !sam OR !SaveAllModule to extract the modules on specific disk location:

!sam c:\notepad

Related questions

WinDbg x64: Cannot debug a crash dump - failed to load data access DLL

I attached WinDbg to a running process and had the process crashed (I have a separate question re. that case). Once the program crashed, WinDbg stopped and allowed me to debug the program. I took a crash dump for further …

Read More
Crash dump - resolve unmanaged code crash in a .NET application using WinDbg

I'm trying to discover the WinDbg tool to analyze a crash dump we have on our production server. When I run !analyze -v, I get: 0:000> !analyze -v ******************************************************************************* * * * Exception Analysis * * * ******************************************************************************* GetPageUrlData failed, server returned HTTP status 404 URL requested: http://watson.…

Read More
WinDbg and SoS, how do I print/dump a large string?

I am debugging a hangdump coming from a production server using WinDbg with the SoS extension. There is a string parameter in one of the stacks, that I need to know the value of. However, it is a rather large …

Read More