Search code examples
windowsdebuggingcrash-dumps

Identify the host from a Windows user mode dump file

Is there an easy way of finding out the host name of a machine that generated a user mode dump file via WinDbg?

Or at least any piece of identifying information to try and confirm that two dump files came from the same system.

Solution

  • You can do so by analyzing the user dump file with WinDbg. Run the !peb command and look for the value of COMPUTERNAME in its output.