Why can't ProcDump record memory contents of a 32-bit process under 64-bit Windows 10?

779 Views Asked by At

I would like to use ProcDump's ability to create minidumps with a custom MINIDUMP_TYPE via the -mc command-line switch to include memory contents beyond MiniDumpNormal.

Unfortunately neither MiniDumpWithFullMemory, MiniDumpWithIndirectlyReferencedMemory, nor MiniDumpWithPrivateReadWriteMemory | MiniDumpWithPrivateWriteCopyMemory seem to have any effect: A nonempty minidump is created without an error being displayed, but a lot smaller than expected and querying the minidump via WinDbg's .dumpdebug functionality does not list any of the aforementioned flags even if explicitly included in the minidump type. It seems as if none of the flags mentioned above have an impact on ProcDump's behavior.

The process in question is a 32-bit process running under 64-bit Windows 10, build 2004. I have tried both procdump.exe and procdump64.exe version 9.0, albeit without the -64 command-line switch since I do not want to include SysWOW64 overhead. I have also tried copying 32-bit and 64-bit versions of dbghelp.dll provided by the most recent Debugging Tools for Windows SDK into the corresponding folders in which procdump.exe and procdump64.exe are located. Finally, I have made sure to pass the minidump type as hexadecimal numbers and any other flags that I have tried seem to be recognized without an issue and are being listed when inspecting the minidump in WinDbg afterwards.

As an example, the invocation procdump.exe -mc 51B25 <process> should create a dump with

0x51B25 = 334629 = (MiniDumpWithDataSegs 
 | MiniDumpWithProcessThreadData
 | MiniDumpWithHandleData
 | MiniDumpWithPrivateReadWriteMemory
 | MiniDumpWithUnloadedModules
 | MiniDumpWithFullMemoryInfo
 | MiniDumpWithThreadInfo
 | MiniDumpWithTokenInformation
 | MiniDumpWithPrivateWriteCopyMemory)

When inspecting the dump in WinDbg, neither MiniDumpWithPrivateReadWriteMemory nor MiniDumpWithPrivateWriteCopyMemory show up in the .dumpdebug information with corresponding memory regions being unavailable. Note that when I create the dump from within the application using MiniDumpWriteDump for demonstration purposes, the flags do show up when using .dumpdebug and the resulting minidump will be significantly larger (under otherwise comparable conditions).

Can someone confirm that ProcDump is indeed ignoring memory-related flags or explain to me what I am doing wrong?

(Writing a MiniPlus dump using the -mp switch does work but does not necessarily include the memory regions of interest.)

0

There are 0 best solutions below