Daeth

Process Dumping doesn't work

13 posts in this topic

I'm trying to dump a process' memory to a file in the temporary directory, similar to Microsoft's ProcDump. The code uses the MinidumpWriteDump function in the dbghelp.dll. Here is the following code. (You need to open Notepad to start)

#NoTrayIcon
#RequireAdmin
#include <WinAPI.au3>
Global Const $MiniDumpNormal = "0x00000000"
Global Const $MiniDumpWithDataSegs = "0x00000001"
Global Const $MiniDumpWithFullMemory = "0x00000002"
Global Const $MiniDumpWithHandleData = "0x00000004"
Global Const $MiniDumpFilterMemory = "0x00000008"
Global Const $MiniDumpScanMemory = "0x00000010"
Global Const $MiniDumpWithUnloadedModules = "0x00000020"
Global Const $MiniDumpWithIndirectlyReferencedMemory = "0x00000040"
Global Const $MiniDumpFilterModulePaths = "0x00000080"
Global Const $MiniDumpWithProcessThreadData = "0x00000100"
Global Const $MiniDumpWithPrivateReadWriteMemory = "0x00000200"
Global Const $MiniDumpWithoutOptionalData = "0x00000400"
Global Const $MiniDumpWithFullMemoryInfo = "0x00000800"
Global Const $MiniDumpWithThreadInfo = "0x00001000"
Global Const $MiniDumpWithCodeSegs = "0x00002000"
Global Const $MiniDumpWithoutAuxiliaryState = "0x00004000"
Global Const $MiniDumpWithFullAuxiliaryState = "0x00008000"
Global Const $MiniDumpWithPrivateWriteCopyMemory = "0x00010000"
Global Const $MiniDumpIgnoreInaccessibleMemory = "0x00020000"
Global Const $MiniDumpWithTokenInformation = "0x00040000"
Global Const $MiniDumpWithModuleHeaders = "0x00080000"
Global Const $MiniDumpFilterTriage = "0x00100000"
Global Const $MiniDumpValidTypeFlags = "0x001fffff"
Global $iProcessPID = ProcessWait("notepad.exe")
Global $hProcess = _WinAPI_OpenProcess("0x0400", 0, $iProcessPID)
Global $hFile = _WinAPI_CreateFile(@TempDir & "\test.dmp", 1)
ConsoleWrite("$iProcessPID = " & $iProcessPID & @CRLF & "$hProcess = " & $hProcess & @CRLF & "$hFile = " & $hFile & @CRLF)
DumpFile($hProcess, $iProcessPID, $hFile, $MiniDumpWithFullMemory)
_WinAPI_CloseHandle($hFile)
_WinAPI_CloseHandle($hProcess)
Exit

Func DumpFile($hProcess, $iPID, $hFile, $dDumpType)
    $hDLL = DllOpen(@SystemDir & "\dbghelp.dll")
    $aResult = DllCall($hDLL, "BOOL", "MiniDumpWriteDump", "HANDLE", $hProcess, "DWORD", $iPID, "HANDLE", $hFile, "DWORD", $dDumpType, "DWORD", Null, "DWORD", Null, "DWORD", Null)
    DllClose($hDLL)
    ConsoleWrite($aResult[0])
EndFunc

$aResult[0] always returns 0, and the "test.dmp" file is always 0 kilobytes.

Share this post


Link to post
Share on other sites



#3 ·  Posted (edited)

@JohnOne I still get a return value of 0 with that code. I tried with this, but still to no avail:

Global $hProcess = _WinAPI_OpenProcess($PROCESS_ALL_ACCESS, 0, $iProcessPID, True)

Could there be anything wrong with the DllCall?

Edited by Daeth

Share this post


Link to post
Share on other sites

@OP: you should be content - that zero as a return value means "success" a dump file was created!

Share this post


Link to post
Share on other sites

@PACaleala No, according to MSDN, it says the return value should be True if a successful dump file was written. Furthermore, the dump file created is 0 bytes.

Share this post


Link to post
Share on other sites

Comment the require admin line and insert the next line before the "Exit" line:

if FileExists(@TempDir & "\test.dmp") Then run ("notepad" & " " & @TempDir & "\test.dmp")

Now run the script from SciTe

Share this post


Link to post
Share on other sites

What is that meant to do? There's nothing in the dumpfile.

Share this post


Link to post
Share on other sites
#include <WinAPI.au3>
;~ #RequireAdmin try to un-comment if not work for you

Local $hFile = _WinAPI_CreateFile(@ScriptDir & "\Test.dmp", 1) ; Creates a new file. If a file exists, it is overwritten
_DumpFile(@AutoItPID, $hFile)
_WinAPI_CloseHandle($hFile)

Func _DumpFile($iPID, $hFile, $dDumpType = 0)
    Local $hProcess = DllCall("kernel32.dll", "handle", "OpenProcess", "dword", 0x0450, "bool", 0, "dword", $iPID)
    If @error Then Return SetError(@error, @extended, 0)
    $aResult = DllCall("dbghelp.dll", "bool", "MiniDumpWriteDump", "handle", $hProcess[0], "dword", $iPID, "handle", $hFile, "dword", $dDumpType, "dword", "", "dword", "", "dword", "")
    DllCall("kernel32.dll", "bool", "CloseHandle", "handle", $hProcess[0])
    If $aResult[0] = 0 Then Return SetError(@error, @extended, False)
    Return $aResult[0]
EndFunc

ivbrlh.png

2 people like this

Nothing is so strong as gentleness. Nothing is so gentle as real strength

 

Share this post


Link to post
Share on other sites

@Terenz Hmm that's odd, your code writes a dump file for @AutoItPID, so I tried using @AutoItPID, in my script as well - which actually works. How do I create a dump file of a system process or "notepad.exe". 

I tested the DumpFile on different applications such as "chrome.exe", but "notepad.exe" doesn't work. When I use the sysinternals 'ProcDump' tool and create a process dump of notepad.exe (procdump -ma notepad.exe), it worked fine.

Share this post


Link to post
Share on other sites

?

#include <WinAPI.au3>
;~ #RequireAdmin try to un-comment if not work for you

Local $iPID = Run("notepad.exe")
;~ Local $iPID = ProcessWait("notepad.exe")
Local $hFile = _WinAPI_CreateFile(@ScriptDir & "\Test.dmp", 1) ; Creates a new file. If a file exists, it is overwritten
_DumpFile($iPID, $hFile)
_WinAPI_CloseHandle($hFile)
ProcessClose($iPID)

Func _DumpFile($iPID, $hFile, $dDumpType = 0)
    Local $hProcess = DllCall("kernel32.dll", "handle", "OpenProcess", "dword", 0x0450, "bool", 0, "dword", $iPID)
    If @error Then Return SetError(@error, @extended, 0)
    $aResult = DllCall("dbghelp.dll", "bool", "MiniDumpWriteDump", "handle", $hProcess[0], "dword", $iPID, "handle", $hFile, "dword", $dDumpType, "dword", "", "dword", "", "dword", "")
    DllCall("kernel32.dll", "bool", "CloseHandle", "handle", $hProcess[0])
    If $aResult[0] = 0 Then Return SetError(@error, @extended, False)
    Return $aResult[0]
EndFunc

35hqpn4.png

1 person likes this

Nothing is so strong as gentleness. Nothing is so gentle as real strength

 

Share this post


Link to post
Share on other sites

@JohnOne you're a genius! That did the trick. How did you know that would solve the problem?

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!


Register a new account

Sign in

Already have an account? Sign in here.


Sign In Now

  • Similar Content

    • VaishnaviBUtpat
      By VaishnaviBUtpat
      <!DOCTYPE html> <html lang="en" xml:lang="en" style="height: 100%;" xmlns="http://www.w3.org/1999/xhtml"> <head> <title></title> <style> * { margin: 0; padding: 0; } .th-lk { color: #3665d0; font-family: Arial; font-size: small; text-decoration: none; } .th-lk { vertical-align: 0px; } .th-menu2 .th-lk { line-height: 2em; margin-bottom: 0px; margin-right: 0px; overflow: hidden; padding: 0; text-decoration: none; text-overflow: ellipsis; white-space: nowrap; width: 100%; } .th-menu2 .th-lk { color: black; font-weight: bold; } .th-menu2 > li > .th-lk { display: block; padding-left: 8px; width: auto; } .th-menu2 .th-menu2-sub-item .th-lk, .th-menu2 .th-menu2-sub-item-hov .th-lk { margin-right: 20px; } .th-menu2-sub-item { position: relative !important; } .th-menu2 .th-menu2-item, .th-menu2 .th-menu2-item-hov, .th-menu2 .th-menu2-sub-item, .th-menu2 .th-menu2-sub-item-hov { background-repeat: repeat-x; border-left-style: solid; border-left-width: 1px; border-right-style: solid; border-right-width: 1px; border-top-style: solid; border-top-width: 1px; height: 2em; list-style: none; margin-bottom: 0px; padding: 0; width: 100%; } .th-menu2 .th-menu2-item, .th-menu2 .th-menu2-item-hov, .th-menu2 .th-menu2-sub-item, .th-menu2 .th-menu2-sub-item-hov { background-color: #ECECEC; background-image: url(sap_skins/default/styling/lshape/chg_butt_det_nav.gif); border-left-color: #d3d1ce; border-right-color: #d3d1ce; border-top-color: #d3d1ce; border-top-width: 0px; } .th-menu2 { border: 0 solid black; left: 0px; list-style: none; margin: 0; padding: 0; position: relative; } .th-menu2 { z-index: 10006; } .th-menu2 { background-color: white; } div { zoom: 1; } .th-sc-content { left: 0px; position: absolute; top: 0px; } .th-sc-container { left: 0px; overflow: hidden; position: relative; top: 0px; } .th-sc-top { position: relative; } .th-sc-top, .th-sc-content, .th-sc-container, .th-sc-buttondown, .th-sc-buttonup { width: 172px; } .th-sc-buttonup, .th-sc-container { z-index: 10101; } .th-sc-top { z-index: 10100; } body, td, th { font-family: Arial,Helvetica,sans-serif; font-size: small; } .th-l-navcontainer, .th_l_downcontainer { border-right-style: solid; border-right-width: 1px; width: 172px; } .th-l-navcontainer, .th_l_downcontainer { background-color: white; border-right-color: #d3d1ce; } body, html { margin: 0px; border: 0; margin: 0; } </style> </head> <body><form name="myFormId" id="myFormId" action="/sap(ZT1TVVJEWDFWVFVsOWZYMTlmTWpNNU9UWmZXWTlwZG5telZ1RGhBSUFBQ3Nyc2tBPT0=)/bc/bsp/sap/crm_ui_frame/BSPWDApplication.do?sap-client=100&amp;sap-language=EN&amp;sap-domainrelax=min" method="post" target="WorkAreaFrame2"><div class="th-ajax-area" id="rootAreaDiv"><div id="C1_W1_V2" tgt="" dhe="false"><table width="100%" style="table-layout: fixed;" cellspacing="0" cellpadding="0"><tbody><tr><td><table width="100%" style="table-layout: fixed;" cellspacing="0" cellpadding="0"><tbody><tr valign="top"><td class="th-l-navcontainer" id="th_l_navcontainer"><div class="th-sc-top" id="C1_W1_V2_thescroll" style="height: 786px;"><div class="th-sc-container" id="C1_W1_V2_thescroll_scbox" style="height: 786px;"><div class="th-sc-content" id="C1_W1_V2_thescroll_sccontent"><div class="th-ajax-area" id="C1_W1_V2_$navbar"><div id="C7_W35_V36" tgt="" dhe="true" excevt="" intevt="c:C7_W35_V36:C1_W1_V2_C7_W35_V36_MainNavigationLinks.do;" automode="true"><div class="th-ajax-area" id="C1_W1_V2_C7_W35_V36_MainNavigationLinks.do"><ul class="th-menu2" id="C7_W35_V36_mainmenu" style="width: 171px;"><li class="th-menu2-sub-item"><a title="Sales Cycle" class="th-lk" id="C7_W35_V36_UTL-SLS" onclick="htmlbSubmitLib('htmlb',this,'thtmlb:link:click:0','myFormId','C7_W35_V36_UTL-SLS','UTL\x2dSLS\x2dWC',0);return false" onfocus="thSaveKbFocus(this);" oncontextmenu="return false;" href="javascript:void(0)">Sales Cycle</a></li></ul></div></div></div></div></div></div></td></tr></tbody></table></td></tr></tbody></table></div></div></form></body> </html> How to capture above HTML element using AutoIT
    • cu0x
      By cu0x
      Hello guys,
       
      im trying to solved a problem that I have.
       
      Need to get some chinese text from an old Wise script, and in the wise file says f.e. Ù×÷ϵͳ¡£ ÇëÉý¼¶Ä. Is there any way to convert it to traditional chinese?
       
      Already tryied the following code...
       
      #include <MsgBoxConstants.au3> Example() Func Example() ; Define the string that will be converted later. ; NOTE: This string may show up as ?? in the help file and even in some editors. ; This example is saved as UTF-8 with BOM. It should display correctly in editors ; which support changing code pages based on BOMs. Local Const $sString = "Ù×÷ϵͳ¡£ ÇëÉý¼¶Ä" ; Temporary variables used to store conversion results. $dBinary will hold ; the original string in binary form and $sConverted will hold the result ; afte it's been transformed back to the original format. Local $dBinary = Binary(""), $sConverted = "" ; Convert the original UTF-8 string to an ANSI compatible binary string. $dBinary = StringToBinary($sString) ; Convert the ANSI compatible binary string back into a string. $sConverted = BinaryToString($dBinary) ; Display the resulsts. Note that the last two characters will appear ; as ?? since they cannot be represented in ANSI. DisplayResults($sString, $dBinary, $sConverted, "ANSI") ; Convert the original UTF-8 string to an UTF16-LE binary string. $dBinary = StringToBinary($sString, 2) ; Convert the UTF16-LE binary string back into a string. $sConverted = BinaryToString($dBinary, 2) ; Display the resulsts. DisplayResults($sString, $dBinary, $sConverted, "UTF16-LE") ; Convert the original UTF-8 string to an UTF16-BE binary string. $dBinary = StringToBinary($sString, 3) ; Convert the UTF16-BE binary string back into a string. $sConverted = BinaryToString($dBinary, 3) ; Display the resulsts. DisplayResults($sString, $dBinary, $sConverted, "UTF16-BE") ; Convert the original UTF-8 string to an UTF-8 binary string. $dBinary = StringToBinary($sString, 4) ; Convert the UTF8 binary string back into a string. $sConverted = BinaryToString($dBinary, 4) ; Display the resulsts. DisplayResults($sString, $dBinary, $sConverted, "UTF8") EndFunc ;==>Example ; Helper function which formats the message for display. It takes the following parameters: ; $sOriginal - The original string before conversions. ; $dBinary - The original string after it has been converted to binary. ; $sConverted- The string after it has been converted to binary and then back to a string. ; $sConversionType - A human friendly name for the encoding type used for the conversion. Func DisplayResults($sOriginal, $dBinary, $sConverted, $sConversionType) MsgBox($MB_SYSTEMMODAL, "", "Original:" & @CRLF & $sOriginal & @CRLF & @CRLF & "Binary:" & @CRLF & $dBinary & @CRLF & @CRLF & $sConversionType & ":" & @CRLF & $sConverted) EndFunc ;==>DisplayResults Thanks a lot!
    • nacerbaaziz
      By nacerbaaziz
      Hi dear
      I want create retractable bar using autoit
      I tried creating slider, but there's a problem with screen reader for the blind, so is there another retractable tape?
      It is advisable to not accept dragging with the keybord only with  mouse
      note:
      This bar is needed in the process of raising and lowering the volume
      I hope that there is a solution to do that
      i waiting your responses.
      Thanks in advance to all members and administrators
    • XanzyX
      By XanzyX
      Is there a function out there that will edit an existing file witha a "Save" and "Cancel" at the bottom?
      Example: Funcrion("TestFile.txt")
    • rte7
      By rte7
      Hello. We work with the BMC Remedy site to manage incidents and would like to automate the processes of clicking through this button code:
      <a href="javascript:" class="btn btn3d menu" style="top:21; left:184; width:21; height:21;"> <img class="btnimg" src="../../../../resources/images/mt_sprites.gif" alt="menu category issue" title=""> </a> I use firefox with mozrepl and autoit with include FF.au3
      I need your help
      I read the topic https://www.autoitscript.com/forum/topic/95595-ffau3-v0601b-10/ but I could not run the code from the listed commands
      ...
      It is necessary to press the button and from the list of the menu of cahorsations to select the item = "zone of trust abonent"
      Screen # 1 http://joxi.ru/52aJK7bh4a7ypA or below.
      1) Press button
      <a href="javascript:" class="btn btn3d menu" style="top:21; left:184; width:21; height:21;"> <img class="btnimg" src="../../../../resources/images/mt_sprites.gif" alt="menu category issue" title=""> </a>
      2) After pressing the button, I need to choose in this menu of 4 items to select an item called "zone of trust abonent", Screen # 2 - http://joxi.ru/p27gwQKHo71VQ2
      html code table items
      <table class="MenuTable" cellpadding="0" cellspacing="0" style="width: 179px;"> <tbody class="MenuTableBody"> <tr class="MenuTableRow"> <td class="MenuEntryName" nowrap="">zone of trust abonent</td> <td class="MenuEntryNoSub" arvalue="zone of trust abonent"></td> </tr> <tr class="MenuTableRow"><td class="MenuEntryName" nowrap="">zone of trust operator</td> <td class="MenuEntryNoSub" arvalue="zone of trust operator"></td> </tr> <tr class="MenuTableRow"><td class="MenuEntryName" nowrap="">zone of trust third operator</td> <td class="MenuEntryNoSub" arvalue="zone of trust third operator"></td></tr> <tr class="MenuTableRow"><td class="MenuEntryNameHover" nowrap="">No settings</td> <td class="MenuEntryNoSubHover" arvalue="No settings"></td> </tr> </tbody> </table>
       
       
      More in detail, I choose from the menu item "zone of trust abonent" Screen # 3 - http://joxi.ru/GrqVq4ZIQEPW4m

       
      3) The choice is made, Screen # 4 http://joxi.ru/v297w6aC3PovLr
      <textarea class="text sr " wrap="off" id="arid_WIN_0_1000002488" cols="20" maxlen="60" style="top:21; left:0; width:179; height:21;" armenu="CFG:PRC:CategoryHPD-Res-T1-Q" mstyle="2" arautoc="1" arautocmb="1" arautocak="0" arautoctt="400" rows="1"> </textarea>
       
      It's all. I would be very grateful to you =) !!!!!!!!!!
      Here are more detailed codes in the attachment. 
      button1.txt
      menu - table.txt
      all.txt