3

Is it possible to dump the occupied memory of a process with Windows 7 API function calls instead of having to install external tools like Windbg? Taskmanager supports simple one-click memory dumps, leading me to believe that it might use the API to pull that off.

I should add, that I'm talking about memory dumps of running applications. Not those that just crashed.

1
  • 1
    You need DbgHelp.dll. It is included with Windows 7. Not in early versions like XP. Always a good idea to just include it with your setup, you can get it from the Windows SDK (formerly "Debugging tools for Windows"). You are allowed to redistribute it. Feb 8, 2012 at 13:46

1 Answer 1

5

There is an API for this: MiniDumpWriteDump. It just requires you to pass in a few handles and an exception structure. To use it you will have to link against the Dbghelp.lib library.

This will create a dump file that is compatible with Visual Studio, so you can load it in and inspect the process memory, callstack .etc

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.