Daeth

Process Dumping doesn't work

13 posts in this topic

I'm trying to dump a process' memory to a file in the temporary directory, similar to Microsoft's ProcDump. The code uses the MinidumpWriteDump function in the dbghelp.dll. Here is the following code. (You need to open Notepad to start)

#NoTrayIcon
#RequireAdmin
#include <WinAPI.au3>
Global Const $MiniDumpNormal = "0x00000000"
Global Const $MiniDumpWithDataSegs = "0x00000001"
Global Const $MiniDumpWithFullMemory = "0x00000002"
Global Const $MiniDumpWithHandleData = "0x00000004"
Global Const $MiniDumpFilterMemory = "0x00000008"
Global Const $MiniDumpScanMemory = "0x00000010"
Global Const $MiniDumpWithUnloadedModules = "0x00000020"
Global Const $MiniDumpWithIndirectlyReferencedMemory = "0x00000040"
Global Const $MiniDumpFilterModulePaths = "0x00000080"
Global Const $MiniDumpWithProcessThreadData = "0x00000100"
Global Const $MiniDumpWithPrivateReadWriteMemory = "0x00000200"
Global Const $MiniDumpWithoutOptionalData = "0x00000400"
Global Const $MiniDumpWithFullMemoryInfo = "0x00000800"
Global Const $MiniDumpWithThreadInfo = "0x00001000"
Global Const $MiniDumpWithCodeSegs = "0x00002000"
Global Const $MiniDumpWithoutAuxiliaryState = "0x00004000"
Global Const $MiniDumpWithFullAuxiliaryState = "0x00008000"
Global Const $MiniDumpWithPrivateWriteCopyMemory = "0x00010000"
Global Const $MiniDumpIgnoreInaccessibleMemory = "0x00020000"
Global Const $MiniDumpWithTokenInformation = "0x00040000"
Global Const $MiniDumpWithModuleHeaders = "0x00080000"
Global Const $MiniDumpFilterTriage = "0x00100000"
Global Const $MiniDumpValidTypeFlags = "0x001fffff"
Global $iProcessPID = ProcessWait("notepad.exe")
Global $hProcess = _WinAPI_OpenProcess("0x0400", 0, $iProcessPID)
Global $hFile = _WinAPI_CreateFile(@TempDir & "\test.dmp", 1)
ConsoleWrite("$iProcessPID = " & $iProcessPID & @CRLF & "$hProcess = " & $hProcess & @CRLF & "$hFile = " & $hFile & @CRLF)
DumpFile($hProcess, $iProcessPID, $hFile, $MiniDumpWithFullMemory)
_WinAPI_CloseHandle($hFile)
_WinAPI_CloseHandle($hProcess)
Exit

Func DumpFile($hProcess, $iPID, $hFile, $dDumpType)
    $hDLL = DllOpen(@SystemDir & "\dbghelp.dll")
    $aResult = DllCall($hDLL, "BOOL", "MiniDumpWriteDump", "HANDLE", $hProcess, "DWORD", $iPID, "HANDLE", $hFile, "DWORD", $dDumpType, "DWORD", Null, "DWORD", Null, "DWORD", Null)
    DllClose($hDLL)
    ConsoleWrite($aResult[0])
EndFunc

$aResult[0] always returns 0, and the "test.dmp" file is always 0 kilobytes.

Share this post


Link to post
Share on other sites



#3 ·  Posted (edited)

@JohnOne I still get a return value of 0 with that code. I tried with this, but still to no avail:

Global $hProcess = _WinAPI_OpenProcess($PROCESS_ALL_ACCESS, 0, $iProcessPID, True)

Could there be anything wrong with the DllCall?

Edited by Daeth

Share this post


Link to post
Share on other sites

@OP: you should be content - that zero as a return value means "success" a dump file was created!

Share this post


Link to post
Share on other sites

@PACaleala No, according to MSDN, it says the return value should be True if a successful dump file was written. Furthermore, the dump file created is 0 bytes.

Share this post


Link to post
Share on other sites

Comment the require admin line and insert the next line before the "Exit" line:

if FileExists(@TempDir & "\test.dmp") Then run ("notepad" & " " & @TempDir & "\test.dmp")

Now run the script from SciTe

Share this post


Link to post
Share on other sites

What is that meant to do? There's nothing in the dumpfile.

Share this post


Link to post
Share on other sites
#include <WinAPI.au3>
;~ #RequireAdmin try to un-comment if not work for you

Local $hFile = _WinAPI_CreateFile(@ScriptDir & "\Test.dmp", 1) ; Creates a new file. If a file exists, it is overwritten
_DumpFile(@AutoItPID, $hFile)
_WinAPI_CloseHandle($hFile)

Func _DumpFile($iPID, $hFile, $dDumpType = 0)
    Local $hProcess = DllCall("kernel32.dll", "handle", "OpenProcess", "dword", 0x0450, "bool", 0, "dword", $iPID)
    If @error Then Return SetError(@error, @extended, 0)
    $aResult = DllCall("dbghelp.dll", "bool", "MiniDumpWriteDump", "handle", $hProcess[0], "dword", $iPID, "handle", $hFile, "dword", $dDumpType, "dword", "", "dword", "", "dword", "")
    DllCall("kernel32.dll", "bool", "CloseHandle", "handle", $hProcess[0])
    If $aResult[0] = 0 Then Return SetError(@error, @extended, False)
    Return $aResult[0]
EndFunc

ivbrlh.png

2 people like this

Nothing is so strong as gentleness. Nothing is so gentle as real strength

 

Share this post


Link to post
Share on other sites

@Terenz Hmm that's odd, your code writes a dump file for @AutoItPID, so I tried using @AutoItPID, in my script as well - which actually works. How do I create a dump file of a system process or "notepad.exe". 

I tested the DumpFile on different applications such as "chrome.exe", but "notepad.exe" doesn't work. When I use the sysinternals 'ProcDump' tool and create a process dump of notepad.exe (procdump -ma notepad.exe), it worked fine.

Share this post


Link to post
Share on other sites

?

#include <WinAPI.au3>
;~ #RequireAdmin try to un-comment if not work for you

Local $iPID = Run("notepad.exe")
;~ Local $iPID = ProcessWait("notepad.exe")
Local $hFile = _WinAPI_CreateFile(@ScriptDir & "\Test.dmp", 1) ; Creates a new file. If a file exists, it is overwritten
_DumpFile($iPID, $hFile)
_WinAPI_CloseHandle($hFile)
ProcessClose($iPID)

Func _DumpFile($iPID, $hFile, $dDumpType = 0)
    Local $hProcess = DllCall("kernel32.dll", "handle", "OpenProcess", "dword", 0x0450, "bool", 0, "dword", $iPID)
    If @error Then Return SetError(@error, @extended, 0)
    $aResult = DllCall("dbghelp.dll", "bool", "MiniDumpWriteDump", "handle", $hProcess[0], "dword", $iPID, "handle", $hFile, "dword", $dDumpType, "dword", "", "dword", "", "dword", "")
    DllCall("kernel32.dll", "bool", "CloseHandle", "handle", $hProcess[0])
    If $aResult[0] = 0 Then Return SetError(@error, @extended, False)
    Return $aResult[0]
EndFunc

35hqpn4.png

1 person likes this

Nothing is so strong as gentleness. Nothing is so gentle as real strength

 

Share this post


Link to post
Share on other sites

@JohnOne you're a genius! That did the trick. How did you know that would solve the problem?

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!


Register a new account

Sign in

Already have an account? Sign in here.


Sign In Now

  • Similar Content

    • FMS
      XML search get change settings.
      By FMS
      Hello ,
      I've the following problem and hope somebody can push me in the right direction or have a good example on how to do it.
      The problem is :I want to search / select / change /check a XML setting in a XML file.
      The example XML file is as following :
      <Configuration> <Categories> <Category Name="default"> <SubCategories> <SubCategory Name="defaultsettings"> <Settings> <Setting Name="machinename" TypeName="System.String" Value="defaultname" /> <Setting Name="cpuspeed" TypeName="System.String" Value="false" /> <Setting Name="cmptemp" TypeName="System.String" Value="false" /> <Setting Name="cmpspeed_set" TypeName="System.String" Value="" /> <Setting Name="cmptemp_set" TypeName="System.String" Value="" /> </Settings> </SubCategory> </SubCategories> </Category> <Category Name="settings"> <SubCategories> <SubCategory Name="comp1"> <Settings> <Setting Name="machinename" TypeName="System.String" Value="comp1" /> <Setting Name="cpuspeed" TypeName="System.String" Value="true" /> <Setting Name="cmptemp" TypeName="System.String" Value="false" /> <Setting Name="cmpspeed_set" TypeName="System.String" Value="12" /> <Setting Name="cmptemp_set" TypeName="System.String" Value="" /> </Settings> </SubCategory> <SubCategory Name="comp2"> <Settings> <Setting Name="machinename" TypeName="System.String" Value="comp2" /> <Setting Name="cpuspeed" TypeName="System.String" Value="false" /> <Setting Name="cmptemp" TypeName="System.String" Value="true" /> <Setting Name="cmpspeed_set" TypeName="System.String" Value="" /> <Setting Name="cmptemp_set" TypeName="System.String" Value="9" /> </Settings> </SubCategory> </SubCategories> </Category> </Categories> </Configuration> In this XML file I want to :
      -search if subcategory whit the name "comp3" exists
      -if exist change of setting "cpuspeed" value to false
      -if not exist make a new subcategory "comp3" whit the default settings from subcategory "default settings"
      what i have this far is :
      Func xml_test1() Dim $return[0] Local $file = @ScriptDir & "\test.xml" FileOpen($file, $FO_READ) _FileReadToArray($file,$return) FileClose($file) msg("",$return[28]) msg("",$return[29]) EndFunc func xml_test2() Local $file = @ScriptDir & "\test.xml" Local $oXML = ObjCreate("Microsoft.XMLDOM") ;~ $oXML.load("D:\___BUILDS___\___SRMT___\test.xml") $oXML.load($file) $oOther= $oXML.SelectSingleNode("//Configuration/Categories/Category/SubCategories/SubCategory/Settings/Setting") ; or //other ConsoleWrite("$oOther.text=[" & $oOther.text & "]" & @CRLF) EndFunc i know it is not enough what I'm trying to do but I'm realy stuk in what to do next.
      I've searched in the XML.udf but could not find in the examples what to do what i want to do.
      The things what i found are about <settings>false</settings> writing style of XML and not the way I've the XML.
      (or I'm reading it wrong)
      Is there somebody who can help me on mine way or has a good example script?
      Thanks in advanced
       
    • Valnurat
      Read of an AD attribute of Octet String syntax
      By Valnurat
      How do you read AD attribute: thumbnailPhoto and show the picture? It is a syntax of octet string.
      I have no code for this.
    • genius257
      Is it possible to throw an error in a ScriptControl object, via AutoIt
      By genius257
      First of all I've been searching on the forum, and while there's been done something like this with: https://www.autoitscript.com/forum/topic/141004-comobject-proxy-seamless-windows-script-control-autoitobj/
      I could not find any solution to my predicament.
       
      Is it possible to throw an error in a ScriptControl object, via AutoIt?
      I have a script, where AutoIt calls ScriptControl:JavaScript which in turn calls AutoIt.
      However i would like to be able to make AutoIt invoke an exception within ScriptControl, if the called functionality fails.
      Here's some code for reference:
      #AutoIt3Wrapper_Run_AU3Check=n #include-once #include "AutoitObject.au3" #include <WinAPIDiag.au3> $oJS = ObjCreate("ScriptControl") $oJS.Language = "JScript" $oJS.TimeOut = 0; A value of 0 means that the ScriptControl will monitor the execution of the script and will trigger the Timeout event if it determines that the script is hung. _AutoItObject_Startup() $oAutoIt = _AutoItObject_Create() _AutoItObject_AddMethod($oAutoIt, "Execute", "_Execute", False) $oJS.AddObject("AutoIt", $oAutoIt, True) OnAutoItExitRegister("_CleanUp") $_AutoItError = ObjEvent("AutoIt.Error", "_AutoItError") Func _CleanUp() ConsoleWrite("Cleaning up..."&@CRLF) $oJS = 0 $oAutoIt = 0 _AutoItObject_Shutdown() EndFunc Func _Execute($oSelf, $sString) $vReturn = Execute($sString) If @error<>0 Then Return $oJS.Eval("throw new SyntaxError();"); Does invoke exception, but not within the try/catch Return $vReturn EndFunc Func _AutoItError($oError) $oError2 = $oJS.Error ConsoleWrite( _ "Column: " & $oError2.Column & @CRLF & _ "Description: " & $oError2.Description & @CRLF & _ "HelpContext: " & $oError2.HelpContext & @CRLF & _ "HelpFile: " & $oError2.HelpFile & @CRLF & _ "Line: " & $oError2.Line & @CRLF & _ "Number: " & $oError2.Number & @CRLF & _ "Source: " & $oError2.Source & @CRLF & _ "Text: " & $oError2.Text & @CRLF _ ) $oError2.Clear() EndFunc $oJS.Eval("(function(){"& _ "try{"& _ "AutoIt.Execute('MsgBox(0,\'\', \'a\')');"& _ "AutoIt.Execute('a.b');/*error should occur here*/"& _ "AutoIt.Execute('MsgBox(0,\'\', \'b\')');"& _ "}catch(e){"& _ "AutoIt.Execute('ConsoleWrite(\'Error\'&@CRLF)');"& _ "}"& _ "})()")  
    • PELock
      Legal AutoIt
      By PELock
      Hi, I'm asking here because I can't get an answer at the official contact mail.
      Is it legal to name software products using "AutoIt" word in it. I saw some 3rd party tools with "AutoIt" word that's why I'm asking.
      So is it legal to name something e.g.:
      "AutoIt Extractor"
      "AutoIt Editor"
      etc.
      ?
    • Miliardsto
      Timers Crashing
      By Miliardsto
      I do my timers like this by clicking checkbox function is called and timer is set up.
      There is a trouble cause I got so many Timers, 20 like this below and I can see if they is launched 5 timers program starts freezing and often crashing.
      I know it takes memory but is is right way to do timers like that or what should i do?
      Case $checkerSS If GUICtrlRead($CheckerOne) = 1 Then $ss = _Timer_SetTimer($Form1,4000,"checkScreen") Else _Timer_KillTimer ($Form1,$ss) EndIf Case $checkerPos If GUICtrlRead($DiscAlert) = 1 Then $disc = _Timer_SetTimer($Form1,20000,"checkPosition") Else _Timer_KillTimer ($Form1,$disc) EndIf Case $checkerVars If GUICtrlRead($AlertPlayerPos) = 1 Then $ap = _Timer_SetTimer($Form1,15000,"checkVars") Else _Timer_KillTimer ($Form1,$ap) EndIf