ufrisk
Minidump built-in module seems partial / corrupted
Hi, An amazing development !!!!
I have one thing I'm wondering about, which is the minidump core module.
When I go to process name -> some process ->minidump -> minidump.dmp, and copy the dmp outside, it seems not to be fully compliant with the minidump format.
Opening in WinDgb (Preview), this is what I'm getting:
Microsoft (R) Windows Debugger Version 10.0.25200.1003 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Users\usr\Desktop\minidump.dmp]
User Mini Dump File with Full Memory: Only application data is available
************* Path validation summary **************
Response Time (ms) Location
Deferred srv*
Symbol search path is: srv*
Executable search path is:
Windows 10 Version 22621 ([ Dump file generated by MemProcFS v5.2.0-86 - The Memory Process File System - https://github.com/ufrisk/MemProcFS ]) MP (16 procs) Free x64
Product: WinNt
Machine Name:
Debug session time: Sun Nov 29 10:54:34.000 2076 (UTC + 2:00)
System Uptime: 0 days 4:24:03.186
Process Uptime: not available
ERROR: Reload failure, partially initialized target
?:???> !analyze
WARNING: The debugger does not have a current process or thread
WARNING: Many commands will not work
Extension called without current PC
*******************************************************************************
* *
* Exception Analysis *
* *
*******************************************************************************
Event is not an exception - analysis may be incorrect
***** Debugger could not find ntdll in module list, module list might be corrupt, error 0x80004005.
Could you please shed some light on why this might be happening? or what changes are to be applied to the project to fix this?
This shouldn't happen. Sometimes corruptions may happen though, but they are pretty rare at least from what I've seen. It complains that it cannot find ntdll.dll - maybe memprocfs failed to parse loaded modules for some reason for that process?
There is really no way for me to properly tell what's causing this issue or if it's due to an error or some corrupt memory from the memory dump.
If possible, I'd be happy to take a look at it though. But I would need the complete physical memory dump to do this. I have full respect if it's not possible to share the memory dump, but if it is I'm willing to take a look. Please zip it, upload it somewhere and send me the link, twitter, discord or email me at [email protected]
I'm closing this issue since I haven't heard anything more about it.
If you do still have the error and may share the memory dump please feel free to contact me about it and I'll look into it.