The raw2dump plugin uses write support to build a _DMP_HEADER64 or _DMP_HEADER
object, and initialize its members. Write support seems to work fine for things
like Comment and SystemTime, but not for DumpType:
'_DMP_HEADER' : [ None, {
'Comment' : [ None, ['String', dict(length = 128)]],
'DumpType' : [ None, ['Enumeration', dict(choices = {0x1: "Full Dump", 0x2: "Kernel Dump"})]],
'SystemTime' : [ None, ['WinTimeStamp', dict(is_utc = True)]],
}],
So we can easily do this:
header.Comment = "Comment"
header.SystemTime = kuser.SystemTime.as_windows_timestamp()
But we cannot do this:
header.DumpType = 1
- OR -
header.DumpType = "FullDump"
Both of the above results in an exception "Struct() argument 1 must be string,
not _DMP_HEADER"
Original issue reported on code.google.com by michael.hale@gmail.com on 7 Feb 2013 at 3:35
Original issue reported on code.google.com by
michael.hale@gmail.com
on 7 Feb 2013 at 3:35