Search code examples
windbgpykd

Getting the process ID from a crash dump file with PyKd


I am analyzing a lot of crash dumps with Pykd and I would like to get the process ID (PID) from the crash dump.

In WinDbg, I'd use the command | and use my brain to figure it out. Some time later, I'd come up with a command like

.foreach /pS 3 /ps 999 ( pid {|}) {.echo ${pid}}

which extracts the process ID for me.

Just a little bit smarter and I'd use a pseudo register instead:

.printf "%p", $tpid

How would I use PyKD to get the process ID from a user mode crash dump file (.dmp)?

Of course I can always do a pykd.dbgCommand(), but I'd like to use a more robust built-in way.

I have tried

  • pykd.getCurrentProcessId() but it returns 0.
  • pykd.reg("tpid") but it says "Invalid register name"

Solution

  • 0:000> dx Debugger.Sessions.First().Processes
    Debugger.Sessions.First().Processes
        [0x294c]         : wait.exe
    0:000> .shell -ci ".echo " type f:\src\wait\pid.py
    from pykd import *
    print(hex(expr("@$tpid"))).shell: Process exited
    0:000> !py f:\src\wait\pid.py
    0x294c
    0:000> |
    .  0    id: 294c        examine name: F:\src\wait\wait.exe
    0:000>