GregTheDev / MinidumpExplorer

Inspect and capture minidump files. Includes stand alone library for reading minidump files.
MIT License
90 stars 19 forks source link

Idea: Search&DumpData to Disk #12

Open cw2k opened 4 years ago

cw2k commented 4 years ago

I just tested MinidumpExplorer. Hmm to me it would add much value to be able to to search & dump certain memory regions from memory Info. Just image your favorite program just crashed and you want to recover certain data from the *.dmp file.

So just make the MemoryInfo tab able to do a multiselection on that listView. Enrich that context menu View with Search and Dump add the handler function that will do what this context menu shows... ... and make me and for sure some other people happy.

Add the filename column from [Module] as well in Memory info. Use Base address as key to join them. Add an option to enable/disable this since its not the actual data as stored in the *.dmp.

GregTheDev commented 4 years ago

Awesome, thanks the ideas, sounds great. I’ll get on it and see what I can do.

GregTheDev commented 3 years ago

I've been giving your ideas quite a bit of thought, and I think I may have been partly wrong in adding the "View" option to the MemoryInfo tab originally.

My reason for thinking this is that the MemoryInfo stream:

"... corresponds to what VirtualQuery would return for the process the dump was created for"

i.e. it's what's the virtual address space of the process looked like while it was running. Depending on what options were used when the dump was created either a lot, or almost none of those regions will actually be included as part of the dump. You could end up selecting "View" over and over and keep getting told that the region couldn't be found inside the dump. This could be very frustrating to the user since there's no easy way to know whether the region is available or not. However, the view does provide very useful information, as can be seen from your ideas :)

Given that, the first thing I'm going to do is add an indicator so that users can tell up front which regions are actually available.

What do you think of this?

MemoryInfoPreview