Can I use WinDbg to dump structs for other platfor

问题:

I'm using WinDbg to dump struct information, for example:

lkd> dt nt!_LIST_ENTRY +0x000 Flink : Ptr32 _LIST_ENTRY +0x004 Blink : Ptr32 _LIST_ENTRY

The example above shows the 32-bit version of the _LIST_ENTRY struct. The 64-bit version is larger, with Blink at 0x008.

I understand that I can debug remote systems or analyze crash dumps, as long as I load the correct symbols for those Windows versions.

My question: Is it possible to dump structs for different Windows versions than the one I am running, without debugging remotely or analyzing a crash dump?

回答1:

Yes so long as you have the correct symbols you can dump structs for different windows versions.

The dump will contain the windows version and signature that is expected for the symbols that must match the pdbs.

EDIT

With respect to your specific issue of debugging a 64-bit dump/process on 32-bit OS, it looks like you need to be on a 64-bit OS and use the 64-bit WinDbg.

回答2:

If you have a 64 bit module ( ntoskrnl.exe for example ) you can load it by "Open Crash Dump..." command and dump information.

Another way: if you have a pdb file for 64 bit module, you can use pdbdump utility