WinDbg to create dump file upon crash?

Question

We're having an exception with our application. Using Dr.Watson we didn't capture any dmp as well log files. I'm told, WinDbg is an alternative to create dump files upon exceptionn/crash of a program. After a googling, I come across a piles of confusion. First of all, I'd like to confirm, whether it is possible, to creat dump files with help of WinDbg. Second, is there any recommended simple command lines to attach WinDbg to an application to get the dump files upon its crash? Thanks alot!

Answer 1

You can use WinDbg .dump command,

.dump /mfh /u C:\crash.dmp 

For crash scenarios, two other tools are more suitable,

• Debug Diag http://support.microsoft.com/kb/2580960
• ADPlus.exe http://blogs.msdn.com/b/cobold/archive/2010/03/01/collection-crash-dumps.aspx

Answer 2

In this situation we usually recommend to our users to download procdump (which can just be extracted from the zip file, no installation required) and then we give them a batch file that contains something like this:

mkdir c:\dumps
procdump -e -c 10 -w myprocess.exe c:\dumps

When the process generates an unhandled exception it will create a dump file in the c:\dumps directory that you can load into Visual Studio or Windbg (the !analyze -v command is your friend)

Answer 3

Choosing the Best Tool confirms that WinDbg will help you create dump files but also provides some alternatives that may be easier to use.

Answer 4

If you can intercept the crash in an exception handler then you can write the dump using code: http://msdn.microsoft.com/en-us/library/windows/desktop/ms680360%28v=vs.85%29.aspx

Otherwise you need to instruct Dr. Watson to intercept and create the dump for you with particular flags that specify the level of detail the dumps will hold: http://blogs.technet.com/b/askperf/archive/2007/06/15/capturing-application-crash-dumps.aspx and http://social.technet.microsoft.com/wiki/contents/articles/8103.application-crash-dump-analysis-windows-7.aspx and msdn

To do this from the command line you need to do something like:

cdb -pn myApp.exe -c ".symfix;.reload;.dump /ma c:\memdump\crash.dmp;qd"

This presumes that cdb.exe path is searchable, you may need to prefix with full path like:

C:\Program Files (x86)\Debugging Tools for Windows (x86)\cdb -pn myApp.exe -c ".symfix;.reload;.dump /ma c:\memdump\crash.dmp;qd"

So the commands here

cdb -pn   -->attaches cdb to your process name myApp.exe
-c        -->execute command
.symfix   -->fix microsoft symbols
.reload   -->reload
.dump /ma c:\memdump\crash.dmp --> write minidump to location (the flags /ma is effectively everything you want)
qd        -->quit and detach

You may not need some of these commands, you can remove them if not needed.