search

skelsec / minidump

Python library to parse and read Microsoft minidump file format
MIT License
272 stars 55 forks source link

Error loading generated minidump files in windbg #29

Open paulkermann opened 2 years ago

paulkermann commented 2 years ago

I tried using your code (in the master branch, and in the writer branch also). Seems like the logic for writing minidump files doesn't work as expected. Loading the resulting file in windbg.exe produces many errors. Some errors are because the _MINIDUMP_TYPE Flags are not set accordingly (WithFullMemory and WithFullMemoryInfo and such).

After fixing that up windbg did not seem to recognise the Memory64ListStream stream because its size was invalid (apparently windbg expects the Size of that directory to be 0x10 * (NumberOfMemoryRanges + 1)). After fixing that up windbg spits out this message:

?:???> db 00007ff7`ab3c0000
WARNING: The debugger does not have a current process or thread
WARNING: Many commands will not work
       ^ Illegal thread error in db 00007ff7`ab3c0000

For practically every command. I think adding thread info (just the basics probably) will make it work.

Looking for your input on this matter. I think getting this functionality working could help many people.

skelsec commented 2 years ago

the minidump writer functionality is not working currently as I haven't seen much interest from users to actually implement it. (started implementing a while ago and I was just meh and moved on)
As currently I'm overburdened with other projects (non public ones sadly) I can't work on this matter in the foreseeable future. PRs are more than welcome, and I will keep this issue open as a reminder for myself.
thank you for the size info!