Search code examples
winapimemorydumpcrash-dumps

Programmatically read memory from win32 dump file


I have a Win32 core dump (full dump, with memory) of a process crash which was caused by a heap corruption. I have full symbols and sources, so opening the dump in the debugger is not a problem.

I'm having problems locating certain values in the memory, and searching through all the data structures in VS's watch windows is problematic (too many to go through).

Is there any way I can access the memory programmatically?

As a simple example, I'd like to find an address in the dumped memory which holds a specific other address. I can complicate it more later once I have this basic example.


Solution

  • You can load the dump file into the windbg debugger. Windbg has a miniature scripting language you can use to drive operations programmatically. Or you can write a windbg debugger extension if the algorithm you want is particularly complicated.