软件调试技巧（一）

一、如何生成dump文件

dump是什么？是一个进程的内存数据的拷贝，程序可以通过一下命令对dump进程生产保存：

程序运行的时候如果产生崩溃，我们都是使用MiniDumpWriteDump生产一个mini dump

BOOL WINAPI MiniDumpWriteDump(
  _In_ HANDLE                            hProcess,
  _In_ DWORD                             ProcessId,
  _In_ HANDLE                            hFile,
  _In_ MINIDUMP_TYPE                     DumpType,
  _In_ PMINIDUMP_EXCEPTION_INFORMATION   ExceptionParam,
  _In_ PMINIDUMP_USER_STREAM_INFORMATION UserStreamParam,
  _In_ PMINIDUMP_CALLBACK_INFORMATION    CallbackParam
);

这是它的原型，下面介绍一下它的参数：

hprocess  ： 顾名思义，进程的句柄

processid ： 进程ID

dumptype ：生成dump的类型

typedef  ENUM  _MINIDUMP_TYPE { 
  MiniDumpNormal                          = 0x00000000,
  MiniDumpWithDataSegs                    = 0x00000001,
  MiniDumpWithFullMemory                  = 0x00000002,
  MiniDumpWithHandleData                  = 0x00000004,
  MiniDumpFilterMemory                    = 0x00000008,
  MiniDumpScanMemory                      = 0x00000010,
  MiniDumpWithUnloadedModules             = 0x00000020,
  MiniDumpWithIndirectlyReferencedMemory  = 0x00000040,
  MiniDumpFilterModulePaths               = 0x00000080,
  MiniDumpWithProcessThreadData           = 0x00000100,
  MiniDumpWithPrivateReadWriteMemory      = 0x00000200,
  MiniDumpWithoutOptionalData             = 0x00000400,
  MiniDumpWithFullMemoryInfo              = 0x00000800,
  MiniDumpWithThreadInfo                  = 0x00001000,
  MiniDumpWithCodeSegs                    = 0x00002000,
  MiniDumpWithoutAuxiliaryState           = 0x00004000,
  MiniDumpWithFullAuxiliaryState          = 0x00008000,
  MiniDumpWithPrivateWriteCopyMemory      = 0x00010000,
  MiniDumpIgnoreInaccessibleMemory        = 0x00020000,
  MiniDumpWithTokenInformation            = 0x00040000,
  MiniDumpWithModuleHeaders               = 0x00080000,
  MiniDumpFilterTriage                    = 0x00100000,
  MiniDumpValidTypeFlags                  = 0x001fffff
} MINIDUMP_TYPE;

MiniDumpNormal： 包含了必要的信息，以及所有线程的堆栈信息

MiniDumpWithDataSegs：包含所有模块数据段的加载，全局变量等，比小型转存储更大。