How to generate kernel dump by using Windbg? -


how generate kernel dump using windbg?

if i'm using command, can generate kernel dump?

.dump /f 

or have use .crash kernel dump?

yes, .dump /f generates kernel dump when you're in kernel debugging mode. it'll not create kernel dump when you're debugging in user mode.

.crash however, crash system, i.e. cause bsod (blue screen of death), not guaranteed generate kernel dump, not full memory kernel dump. there conditions .crash work:

  1. bsod crash dumps must configured, if want full ram
  2. the system must have page file
  3. the page file must large enough keep ram + bit of overhead
  4. the page file must on system partiion
  5. there must enough free disk space copy dump page file disk during next startup

a similar effect can achieved sysinternals notmyfault /crash, suffers under same conditions.

so, more reliable way .dump.

as mentioned sean cline before, can use sysinternals livekd -o , perhaps -m switch generate kernel dump.

there other options well, never applied them myself, e.g. never managed take kernel dump via ctrl+scroll+scroll.


Comments

Popular posts from this blog

dns - How To Use Custom Nameserver On Free Cloudflare? -

python - Pygame screen.blit not working -

c# - Web API response xml language -