How can I read a minidump?

4
votes

I have a minidump written to a file via: MiniDumpWriteDump. The file was sent to me from a client (i.e. I cannot use some sort of just-in-time debugger). My question is: how do I open it? Visual Studio gives the error: "Debugging older format crashdumps is not supported." I googled that and found that people were opening kernel dumps with visual studio. This is not a kernel dump, just a dump of an app crash. I also tried to open it with WinDbg, but that was unable to open it as well. How can I get the information?

2
c++cwindowscoredumpminidump
What specific error(s) do you get with windbg? That should work. - Joe
@Joe "Could not find the C:\dump.dmp Dump File, Win32 error 0n87. The Parameter is incorrect." - chacham15
What platform are you on, and what ver of Windbg? - Joe
@Joe Win7x64 Windbg:6.2.9200.16384 X86 (the executable is 32-bit) - chacham15
@HansPassant I mirrored the situation using my machine as the client and I get the same result. - chacham15

2 Answers

2
votes

The tool: http://technet.microsoft.com/el-gr/sysinternals/dd996900.aspx

A post you didn't see already in stackoverflow: Getting started with dump file analysis

If you're still having a problem send me the minidump file. I was interested some time ago but reading these files is toooo frustrating!

PS: Book i used: http://books.google.gr/books/about/Windows_Forensic_Analysis_DVD_Toolkit.html?id=6LX9PRoX5zgC&redir_esc=y

0
votes

Just use

BOOL WINAPI MiniDumpReadDumpStream(
  _In_   PVOID BaseOfDump,
  _In_   ULONG StreamNumber,
  _Out_  PMINIDUMP_DIRECTORY *Dir,
  _Out_  PVOID *StreamPointer,
  _Out_  ULONG *StreamSize
);

MiniDumpReadDumpStream