Search code examples
windbgcallstackusermode

switching to user stack in kernel dumps

Is there a way to switch to user mode of a particular process in a kernel dump while doing postmortem debugging ?

I remember doing this while live debugging using the .process command.

Solution

  • .process also works in kernel dumps. First, you can find your process using

    !process 0 0 myprocess.exe

    and then switch to that process using

    .process <address>

    where <address> is the hex number after PROCESS.

    Note that you are still kernel debugging and you have only the physical memory of that process available (a.k.a. Working Set). The majority of virtual address space is probably swapped to disk and you cannot analyze that process as you would in user mode (especially for .NET programs, where you need the complete .NET heap).