How to generate kernel dump by using Windbg? -
how generate kernel dump using windbg?
if i'm using command, can generate kernel dump?
.dump /f
or have use .crash
kernel dump?
yes, .dump /f
generates kernel dump when you're in kernel debugging mode. it'll not create kernel dump when you're debugging in user mode.
.crash
however, crash system, i.e. cause bsod (blue screen of death), not guaranteed generate kernel dump, not full memory kernel dump. there conditions .crash
work:
- bsod crash dumps must configured, if want full ram
- the system must have page file
- the page file must large enough keep ram + bit of overhead
- the page file must on system partiion
- there must enough free disk space copy dump page file disk during next startup
a similar effect can achieved sysinternals notmyfault /crash
, suffers under same conditions.
so, more reliable way .dump
.
as mentioned sean cline before, can use sysinternals livekd -o
, perhaps -m
switch generate kernel dump.
there other options well, never applied them myself, e.g. never managed take kernel dump via ctrl+scroll+scroll.
Comments
Post a Comment