Advanced Windows Debugging – II

Using User Dump utility to generate user process dump:

Instructions for the USERDUMP Utility:

==========================

2. Run the Setup.exe program that comes with the Userdump tool.

This installs a kernel-mode driver Userdump.sys and also creates a

Control Panel applet called "Process Dump"

3. Open the control panel applet called "Process Dump"

4. Click the ‘New’ button and enter the name of the executable that you want to monitor

(you do not need to type in the full path…just the executable file name like spoolsv.exe)

5. Click OK

6. Highlight the name of the App under the "Application to Monitor" field on the main screen

7. Click the "Rules" Button

8. Select "Use default rules" then click the "Default Rules" button.

9. Make sure that "All Exceptions" is NOT checked

10. Then click on the "Select all" button

(this is different than selecting the All Exceptions checkbox).

11. Click OK

12. Try to reproduce the problem or wait till the problem occurs

More information:

============

This will dump any and all exceptions in the selected application.
The dump file created will be %windir%<the name of the app>.DMP
You can specify where to place the dump file by setting a string (REG_SZ) value called DumpPath in the following registry key:

HKEY_LOCAL_MACHINESystemCurrentControlSetServicesudmpsvcParameters.

Note you may need to create the key called Parameters and then a new string value called DumpPath

Userdump is an update of the DotCrash utility, but unlike dotcrash, userdump will not terminate an application that it traps an exception on. In some cases userdump may be unable to generate a dump file at this point you’ll need to run Userdump interactively while the problem is occurring.
To Run userdump interactively issue the following command from the directory where Userdump.exe is located:

Userdump -p (this will list the PID numbers of all running processes)

Once you’ve determined the PID number of the process you want to dump, issue the following command:

Userdump {PID number} Filename.dmp

For Example: Userdump 232 iexplore.dmp