WINDBG: Display dump file capture flags

Question

This is a very quick question. I searched and can't seem to find the windbg command that would show what options exist in a minidump file.

Additionally, I would like to get back the equivalent argument to the .dump command that would generate the same type of minidump, for example .dump /ma.

score 6 · Accepted Answer · answered Sep 26 '11 at 14:27

6

.dumpdebug will give you the flags that the mini-dump was created with. For example:

0:000> .dumpdebug
----- User Mini Dump Analysis

MINIDUMP_HEADER:
Version         A793 (6C02)
NumberOfStreams 11
Flags           1806
                0002 MiniDumpWithFullMemory
                0004 MiniDumpWithHandleData
                0800 MiniDumpWithFullMemoryInfo
                1000 MiniDumpWithThreadInfo

It will also spew lots of other information, so just be patient and then scroll back to the top :)

-scott

answered Sep 26 '11 at 14:27

snoone

5,409
18
19

It works but oddly enough it's not in the help file packaged with windbg 6.12.0002.633 – Flame Sep 26 '11 at 16:08
It's an undocumented command, though it's been there for a while. – snoone Sep 26 '11 at 18:02

score 1 · Answer 2 · answered Sep 23 '11 at 17:24

1

When you first open a dump usually the 4th line of text will be something like this:

User Mini Dump File with Full Memory: Only application data is available

or

User Mini Dump File: Only registers, stack and portions of memory are available

This will obviously change depending upon what the options were.

answered Sep 23 '11 at 17:24

Zipper

7,034
8
49
66

Huh. Never paid attention to this text before. Doesn't map back exactly but its a start. – Flame Sep 23 '11 at 19:20

WINDBG: Display dump file capture flags

2 Answers2

Linked