.dump (Create Dump File)
The .dump command creates a user-mode or kernel-mode crash dump file.
.dump Options FileName .dump /?
Represents one or more of the following options
Overwrites an existing dump file with the same name. If this option is not used and there is a file with the same file name, the dump file is not written.
(Kernel mode:) Creates a complete memory dump.
(User mode:) Creates a full user-mode dump. Despite their names, the largest minidump file actually contains more information than a full user-mode dump. For example, .dump /mf or .dump /ma creates a larger and more complete file than .dump /f. In user mode, .dump /m[MiniOptions] is always preferable to .dump /f.
You can add the following FullOptions to change the contents of the dump file; the option is case-sensitive.
Adds AVX register information to the dump file.
In user mode, /m can be followed with additional MiniOptions specifying extra data that is to be included in the dump. If no MiniOptions are included, the dump will include module, thread, and stack information, but no additional data. You can add any of the following MiniOptions to change the contents of the dump file; they are case-sensitive.
Creates a minidump with all optional additions. The /ma option is equivalent to /mfFhut -- it adds full memory data, handle data, unloaded module information, basic memory information, and thread time information to the minidump. Any failure to read inaccessable memory results in termination of the minidump generation.
The /mA option is equivalent to /ma except that it ignores any failure to read inaccessable memory and continues generating the minidump.
Adds full memory data to the minidump. All accessible committed pages owned by the target application will be included.
Adds all basic memory information to the minidump. This adds a stream to the minidump that contains all basic memory information, not just information about valid memory. This allows the debugger to reconstruct the complete virtual memory layout of the process when the minidump is being debugged.
Adds data about the handles associated with the target application to the minidump.
Adds unloaded module information to the minidump. This is available only in Windows Server 2003 and later versions of Windows.
Adds additional thread information to the minidump. This includes thread times, which can be displayed by using the !runaway extension or the .ttime (Display Thread Times) command when debugging the minidump.
Adds secondary memory to the minidump. Secondary memory is any memory referenced by a pointer on the stack or backing store, plus a small region surrounding this address.
Adds process environment block (PEB) and thread environment block (TEB) data to the minidump. This can be useful if you need access to Windows system information regarding the application's processes and threads.
Adds all committed read-write private pages to the minidump.
Adds all read-write data segments within the executable image to the minidump.
Adds code sections within images.
Deletes from the minidump those portions of the stack and store memory that are not useful for recreating the stack trace. Local variables and other data type values are deleted as well. This option does not make the minidump smaller (because these memory sections are simply zeroed), but it is useful if you want to protect the privacy of other applications.
Deletes the full module paths from the minidump. Only the module names will be included. This is a useful option if you want to protect the privacy of the user's directory structure.
Adds AVX register information to the dump file.
These MiniOptions can only be used when creating a user-mode minidump. They should follow the /m specifier.
Appends the date, time, and PID to the dump file names. This ensures that dump file names are unique.
Generates dumps for all currently-debugged processes. If /a is used, the /u option should also be used to ensure that each file has a unique name.
Creates a .cab file. If this option is included, FileName is interpreted as the CAB file name, not the dump file name. A temporary dump file will be created, this file will be packaged into a CAB, and then the dump file will be deleted. If the b option is followed by a, all symbol and image files also will be packaged into the CAB.
- /c "Comment"
Specifies a comment string that will be written to the dump file. If Comment contains spaces, it must be enclosed in double quotes. When the dump file is loaded, the Comment string will be displayed.
- /xc Address
(User mode minidumps only) Adds a context record to the dump file. Address must specify the address of the context record.
- /xr Address
(User mode minidumps only) Adds an exception record to the dump file. Address must specify the address of the exception record.
- /xp Address
(User mode minidumps only) Adds a context record and an exception record to the dump file. Address must specify the address of an EXCEPTION_POINTERS structure which contains pointers to the context record and the exception record.
- /xt ThreadID
(User mode minidumps only) Specifies the thread ID of the system thread that will be used as the exception thread for this dump file.
- /kpmf File
(Only when creating a kernel-mode Complete Memory Dump) Specifies a file that contains physical memory page data.
Specifies the name of the dump file. You can specify a full path and file name or just the file name. If the file name contains spaces, FileName should be enclosed in quotation marks. If no path is specified, the current directory is used.
Displays help for this command. This text is different in kernel mode and in user mode.
user mode, kernel mode
live, crash dump
For a description of kernel-mode dump files and an explanation of their use, see Kernel-Mode Dump Files. For a description of user-mode dump files and an explanation of their use, see User-Mode Dump Files.
This command can be used in a variety of situations:
During live user-mode debugging, this command directs the target application to generate a dump file, but the target application does not terminate.
During live kernel-mode debugging, this command directs the target computer to generate a dump file, but the target computer does not crash.
During crash dump debugging, this command creates a new crash dump file from the old one. This is useful if you have a large crash dump file and want to create a smaller one.
You can control what type of dump file will be produced:
In user mode, .dump /m[MiniOptions] is the best choice. Although "m" stands for "minidump", the dump files created by using this MiniOption can vary in size from very small to very large. By specifying the proper MiniOptions you can control exactly what information is included. For example, .dump /ma produces a dump with a great deal of information. The older command, .dump /f, produces a moderately large "standard dump" file and cannot be customized.
You cannot specify which process is dumped. All running processes will be dumped.
The /xc, /xr, /xp, and /xt options are used to store exception and context information in the dump file. This allows the .ecxr (Display Exception Context Record) command to be run on this dump file.
The following example will create a user-mode minidump, containing full memory and handle information:
0:000> .dump /mfh myfile.dmp
Handle information can be read by using the !handle extension command.