一、如何生成dump文件
dump是什么?是一个进程的内存数据的拷贝,程序可以通过一下命令对dump进程生产保存:
程序运行的时候如果产生崩溃,我们都是使用MiniDumpWriteDump生产一个mini dump
BOOL WINAPI MiniDumpWriteDump( _In_ HANDLE hProcess, _In_ DWORD ProcessId, _In_ HANDLE hFile, _In_ MINIDUMP_TYPE DumpType, _In_ PMINIDUMP_EXCEPTION_INFORMATION ExceptionParam, _In_ PMINIDUMP_USER_STREAM_INFORMATION UserStreamParam, _In_ PMINIDUMP_CALLBACK_INFORMATION CallbackParam );这是它的原型,下面介绍一下它的参数:
hprocess : 顾名思义,进程的句柄
processid : 进程ID
dumptype :生成dump的类型
typedef ENUM _MINIDUMP_TYPE { MiniDumpNormal = 0x00000000, MiniDumpWithDataSegs = 0x00000001, MiniDumpWithFullMemory = 0x00000002, MiniDumpWithHandleData = 0x00000004, MiniDumpFilterMemory = 0x00000008, MiniDumpScanMemory = 0x00000010, MiniDumpWithUnloadedModules = 0x00000020, MiniDumpWithIndirectlyReferencedMemory = 0x00000040, MiniDumpFilterModulePaths = 0x00000080, MiniDumpWithProcessThreadData = 0x00000100, MiniDumpWithPrivateReadWriteMemory = 0x00000200, MiniDumpWithoutOptionalData = 0x00000400, MiniDumpWithFullMemoryInfo = 0x00000800, MiniDumpWithThreadInfo = 0x00001000, MiniDumpWithCodeSegs = 0x00002000, MiniDumpWithoutAuxiliaryState = 0x00004000, MiniDumpWithFullAuxiliaryState = 0x00008000, MiniDumpWithPrivateWriteCopyMemory = 0x00010000, MiniDumpIgnoreInaccessibleMemory = 0x00020000, MiniDumpWithTokenInformation = 0x00040000, MiniDumpWithModuleHeaders = 0x00080000, MiniDumpFilterTriage = 0x00100000, MiniDumpValidTypeFlags = 0x001fffff } MINIDUMP_TYPE;
MiniDumpNormal: 包含了必要的信息,以及所有线程的堆栈信息
MiniDumpWithDataSegs:包含所有模块数据段的加载,全局变量等,比小型转存储更大。