模仿 livekd 写的一个工具,可以在本机上动态生成完整内核 dump 文件,方便本机内核调试,或者事后调试,可能对于保存当前系统状态也有点用。和 livekd 不同,livedump 生成的是一个完整 dump 文件,而没有采用文件过滤驱动的方式。当前支持 xp 以后的 32 位系统,但我只在 32 位 xpsp2 和 vista 系统上测试通过,使用过程产生的任何问题请自己负责。
D:\WinDBG>livedump d:\DmpFiles\live_vista.dmp
LiveDump v1.0 - Generate full kernel mode dump file on a live system
xiaoweitech - http://hi.baidu.com/xiaoweitech
Copyright (C) 2008 xiaowei
Usage: livedump [dump file name]
start dump ... successed!
D:\WinDBG>kd -z d:\DmpFiles\live_vista.dmp
Microsoft (R) Windows Debugger Version 6.8.0004.0 X86
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [d:\DmpFiles\live_vista.dmp]
Kernel Complete Dump File: Full address space is available
Comment: 'This dump file is generated by LiveDump (http://hi.baidu.com/xiaoweitech)'
Symbol search path is: srv*E:\WebSymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows Vista Kernel Version 6000 MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 6000.16584.x86fre.vista_gdr.071023-1545
Kernel base = 0x82000000 PsLoadedModuleList = 0x82111e10
Debug session time: Sun Apr 13 21:13:58.005 2008 (GMT+8)
System Uptime: 49336 days 0:17:26.005
Loading Kernel Symbols
........................................................................................................................
.....................................
Loading User Symbols
Use !analyze -v to get detailed debugging information.
BugCheck 1E, {80000003, df9734b0, 0, 0}
*** ERROR: Module load completed but symbols could not be loaded for LDumpDrv.sys
Probably caused by : Unknown_Image ( LDumpDrv+4b0 )
Followup: MachineOwner
---------
16.0: kd> vertarget
Windows Vista Kernel Version 6000 MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 6000.16584.x86fre.vista_gdr.071023-1545
Kernel base = 0x82000000 PsLoadedModuleList = 0x82111e10
Debug session time: Sun Apr 13 21:13:58.005 2008 (GMT+8)
System Uptime: 49336 days 0:17:26.005