Click here to Skip to main content
15,905,683 members
Please Sign up or sign in to vote.
0.00/5 (No votes)
See more:
Is anyone aware of a utility that can display a process' virtual address space usage from a DMP file for that process?

For example, if the process were currently executing, you would obtain this information using VirtualQueryEx - you could walk the entire virtual address space of the process and detmerine how it was using memory.

I would like to be able to do that from the contents of the DMP file.

Any ideas or utilities known to do this?
Posted

Well, you can definitely open up the .dmp file in WinDbg (or possibly Visual Studio) and examine the process memory.

You can see the RVA and contents of the pages in a full dump, but I'm not sure you can get much information about the memory pages themselves. According to a couple of pages I found on Google, the .dmp file format doesn't appear to store that type of information.

See http://computer.forensikblog.de/en/2006/03/dmp_file_structure.html[^] and http://computer.forensikblog.de/en/2008/02/64bit_crash_dumps.html[^]
 
Share this answer
 
Thanks for the links Kythen.

I think I will have the custom dump file generator collect the information and add that to a user stream in the DMP file.
 
Share this answer
 

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)



CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900