Archive for November, 2008
Today’s a new day: win32dd 1.2 out!
by Matthieu Suiche on Nov.05, 2008, under Windows
Download win32dd v1.2.20081105 now!
New features coming into this version — but the most notable feature is the capacity to generate Microsoft crash dump file without rebooting or generating a BSOD. This mean you can load your memory snapshot into WinDbg.
Here is a sample of output using WinDbg
-
Symbol search path is: SRV*C:\WINDOWS\Symbols*http://msdl.microsoft.com/download/symbols
-
Executable search path is:
-
Windows Server 2008 Kernel Version 6001 (Service Pack 1) UP Free x86 compatible
-
Product: WinNt, suite: TerminalServer SingleUserTS
-
Built by: 6001.18000.x86fre.longhorn_rtm.080118-1840
-
Kernel base = 0×81818000 PsLoadedModuleList = 0×8192fc70
-
Debug session time: Wed Nov 5 01:43:02.460 2008 (GMT-8)
-
System Uptime: 0 days 0:10:45.293
-
WARNING: Process directory table base 3DA26440 doesn‘t match CR3 00122000
-
WARNING: Process directory table base 3DA26440 doesn’t match CR3 00122000
-
Loading Kernel Symbols
-
…………………………………………………………………………………………………………………….
-
Loading User Symbols
-
…………
-
Loading unloaded module list
-
…..
-
kd> !process 0 0
-
**** NT ACTIVE PROCESS DUMP ****
-
PROCESS 82f58910 SessionId: none Cid: 0004 Peb: 00000000 ParentCid: 0000
-
DirBase: 00122000 ObjectTable: 862000b8 HandleCount: 512.
-
Image: System
-
-
PROCESS 852032d0 SessionId: none Cid: 0190 Peb: 7ffdf000 ParentCid: 0004
-
DirBase: 3da26020 ObjectTable: 87bd8008 HandleCount: 28.
-
Image: smss.exe
-
-
PROCESS 84b58b68 SessionId: 0 Cid: 0200 Peb: 7ffd8000 ParentCid: 01f4
-
DirBase: 3da26060 ObjectTable: 8c954fc8 HandleCount: 406.
-
Image: csrss.exe
-
[..]
-
kd> lm
-
start end module name
-
00400000 00413000 win32dd_400000 (deferred)
-
77290000 7733a000 msvcrt (deferred)
-
77340000 77403000 RPCRT4 (deferred)
-
77410000 7748d000 USP10 (deferred)
-
77720000 777e6000 ADVAPI32 (deferred)
-
777f0000 7788d000 USER32 (deferred)
-
77890000 7796b000 kernel32 (deferred)
-
77b50000 77c18000 MSCTF (deferred)
-
77c20000 77d47000 ntdll (pdb symbols) C:\WINDOWS\Symbols\ntdll.pdb\B958B2F91A5A46B889DAFAB4D140CF252\ntdll.pdb
-
77d50000 77d59000 LPK (deferred)
-
77d80000 77d9e000 IMM32 (deferred)
-
77e30000 77e7b000 GDI32 (deferred)
-
80406000 8040e000 kdcom (deferred)
-
8040e000 8041f000 PSHED (deferred)
-
8041f000 80427000 BOOTVID (deferred)
-
80427000 80468000 CLFS (deferred)
-
[..]
In addition to \\Device\\PhysicalMemory reading, win32dd 1.2 provides an option (level) to directly use physical memory address mapping (Microsoft API) to avoid to access the physical memory device.
The crashdump generation take care of the previous blogpost. And works from Windows 2000 to Windows 2008 and probably Windows Seven.
Feel free to give some feedback!
I’d like to thanks Aaron for his positive influence on win32dd developement :)
