2 * MiniDump dumping utility
4 * Copyright 2005 Eric Pouech
6 * This library is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU Lesser General Public
8 * License as published by the Free Software Foundation; either
9 * version 2.1 of the License, or (at your option) any later version.
11 * This library is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 * Lesser General Public License for more details.
16 * You should have received a copy of the GNU Lesser General Public
17 * License along with this library; if not, write to the Free Software
18 * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
28 static void dump_mdmp_data(const MINIDUMP_LOCATION_DESCRIPTOR
* md
, const char* pfx
)
31 dump_data(PRD(md
->Rva
, md
->DataSize
), md
->DataSize
, pfx
);
34 static void dump_mdmp_string(DWORD rva
)
36 const MINIDUMP_STRING
* ms
= PRD(rva
, sizeof(MINIDUMP_STRING
));
40 dump_unicode_str( ms
->Buffer
, ms
->Length
/ sizeof(WCHAR
) );
45 enum FileSig
get_kind_mdmp(void)
49 pdw
= PRD(0, sizeof(DWORD
));
50 if (!pdw
) {printf("Can't get main signature, aborting\n"); return SIG_UNKNOWN
;}
52 if (*pdw
== 0x504D444D /* "MDMP" */) return SIG_MDMP
;
56 static inline void print_longlong(const char *title
, ULONG64 value
)
58 printf("%s: 0x", title
);
59 if (sizeof(value
) > sizeof(unsigned long) && value
>> 32)
60 printf("%lx%08lx\n", (unsigned long)(value
>> 32), (unsigned long)value
);
62 printf("%lx\n", (unsigned long)value
);
65 static inline void print_longlong_range(const char *title
, ULONG64 start
, ULONG64 length
)
67 ULONG64 value
= start
;
68 printf("%s: 0x", title
);
69 if (sizeof(value
) > sizeof(unsigned long) && value
>> 32)
70 printf("%lx%08lx-", (unsigned long)(value
>> 32), (unsigned long)value
);
72 printf("%lx-", (unsigned long)value
);
73 value
= start
+ length
;
74 if (sizeof(value
) > sizeof(unsigned long) && value
>> 32)
75 printf("0x%lx%08lx\n", (unsigned long)(value
>> 32), (unsigned long)value
);
77 printf("0x%lx\n", (unsigned long)value
);
82 const MINIDUMP_HEADER
* hdr
= PRD(0, sizeof(MINIDUMP_HEADER
));
83 const MINIDUMP_DIRECTORY
* dir
;
90 printf("Cannot get Minidump header\n");
94 printf("Signature: %#x (%.4s)\n", hdr
->Signature
, (const char*)&hdr
->Signature
);
95 printf("Version: %#x\n", hdr
->Version
);
96 printf("NumberOfStreams: %u\n", hdr
->NumberOfStreams
);
97 printf("StreamDirectoryRva: %u\n", (UINT
)hdr
->StreamDirectoryRva
);
98 printf("CheckSum: %#x (%u)\n", hdr
->CheckSum
, hdr
->CheckSum
);
99 printf("TimeDateStamp: %s\n", get_time_str(hdr
->TimeDateStamp
));
100 print_longlong("Flags", hdr
->Flags
);
102 for (idx
= 0; idx
< hdr
->NumberOfStreams
; ++idx
)
104 dir
= PRD(hdr
->StreamDirectoryRva
+ idx
* sizeof(MINIDUMP_DIRECTORY
), sizeof(*dir
));
107 stream
= PRD(dir
->Location
.Rva
, dir
->Location
.DataSize
);
109 printf("Stream [%u]: ", idx
);
110 switch (dir
->StreamType
)
112 case ThreadListStream
:
114 const MINIDUMP_THREAD_LIST
*mtl
= stream
;
115 const MINIDUMP_THREAD
*mt
= mtl
->Threads
;
117 printf("Threads: %u\n", (UINT
)mtl
->NumberOfThreads
);
118 for (i
= 0; i
< mtl
->NumberOfThreads
; i
++, mt
++)
120 printf("Thread: #%d\n", i
);
121 printf(" ThreadId: %u\n", mt
->ThreadId
);
122 printf(" SuspendCount: %u\n", mt
->SuspendCount
);
123 printf(" PriorityClass: %u\n", mt
->PriorityClass
);
124 printf(" Priority: %u\n", mt
->Priority
);
125 print_longlong(" Teb", mt
->Teb
);
126 print_longlong_range(" Stack", mt
->Stack
.StartOfMemoryRange
, mt
->Stack
.Memory
.DataSize
);
127 dump_mdmp_data(&mt
->Stack
.Memory
, " ");
128 printf(" ThreadContext:\n");
129 dump_mdmp_data(&mt
->ThreadContext
, " ");
133 case ModuleListStream
:
136 const MINIDUMP_MODULE_LIST
*mml
= stream
;
137 const MINIDUMP_MODULE
* mm
= mml
->Modules
;
141 printf("Modules (%s): %u\n",
142 dir
->StreamType
== ModuleListStream
? "PE" : "ELF",
143 mml
->NumberOfModules
);
144 for (i
= 0; i
< mml
->NumberOfModules
; i
++, mm
++)
146 printf(" Module #%d:\n", i
);
147 print_longlong(" BaseOfImage", mm
->BaseOfImage
);
148 printf(" SizeOfImage: %#x (%u)\n", mm
->SizeOfImage
, mm
->SizeOfImage
);
149 printf(" CheckSum: %#x (%u)\n", mm
->CheckSum
, mm
->CheckSum
);
150 printf(" TimeDateStamp: %s\n", get_time_str(mm
->TimeDateStamp
));
151 printf(" ModuleName: ");
152 dump_mdmp_string(mm
->ModuleNameRva
);
154 printf(" VersionInfo:\n");
155 printf(" dwSignature: %x\n", (UINT
)mm
->VersionInfo
.dwSignature
);
156 printf(" dwStrucVersion: %x\n", (UINT
)mm
->VersionInfo
.dwStrucVersion
);
157 printf(" dwFileVersion: %d,%d,%d,%d\n",
158 HIWORD(mm
->VersionInfo
.dwFileVersionMS
),
159 LOWORD(mm
->VersionInfo
.dwFileVersionMS
),
160 HIWORD(mm
->VersionInfo
.dwFileVersionLS
),
161 LOWORD(mm
->VersionInfo
.dwFileVersionLS
));
162 printf(" dwProductVersion %d,%d,%d,%d\n",
163 HIWORD(mm
->VersionInfo
.dwProductVersionMS
),
164 LOWORD(mm
->VersionInfo
.dwProductVersionMS
),
165 HIWORD(mm
->VersionInfo
.dwProductVersionLS
),
166 LOWORD(mm
->VersionInfo
.dwProductVersionLS
));
167 printf(" dwFileFlagsMask: %x\n", (UINT
)mm
->VersionInfo
.dwFileFlagsMask
);
168 printf(" dwFileFlags: %s%s%s%s%s%s\n",
169 mm
->VersionInfo
.dwFileFlags
& VS_FF_DEBUG
? "Debug " : "",
170 mm
->VersionInfo
.dwFileFlags
& VS_FF_INFOINFERRED
? "Inferred " : "",
171 mm
->VersionInfo
.dwFileFlags
& VS_FF_PATCHED
? "Patched " : "",
172 mm
->VersionInfo
.dwFileFlags
& VS_FF_PRERELEASE
? "PreRelease " : "",
173 mm
->VersionInfo
.dwFileFlags
& VS_FF_PRIVATEBUILD
? "PrivateBuild " : "",
174 mm
->VersionInfo
.dwFileFlags
& VS_FF_SPECIALBUILD
? "SpecialBuild " : "");
175 if (mm
->VersionInfo
.dwFileOS
)
177 switch (mm
->VersionInfo
.dwFileOS
& 0x000F)
179 case VOS__BASE
: p1
= "_base"; break;
180 case VOS__WINDOWS16
:p1
= "16 bit Windows"; break;
181 case VOS__PM16
: p1
= "16 bit Presentation Manager"; break;
182 case VOS__PM32
: p1
= "32 bit Presentation Manager"; break;
183 case VOS__WINDOWS32
:p1
= "32 bit Windows"; break;
184 default: p1
= "---"; break;
186 switch (mm
->VersionInfo
.dwFileOS
& 0xF0000)
188 case VOS_UNKNOWN
: p2
= "unknown"; break;
189 case VOS_DOS
: p2
= "DOS"; break;
190 case VOS_OS216
: p2
= "16 bit OS/2"; break;
191 case VOS_OS232
: p2
= "32 bit OS/2"; break;
192 case VOS_NT
: p2
= "Windows NT"; break;
193 default: p2
= "---"; break;
195 printf(" dwFileOS: %s running on %s\n", p1
, p2
);
197 else printf(" dwFileOS: 0\n");
198 switch (mm
->VersionInfo
.dwFileType
)
200 case VFT_UNKNOWN
: p1
= "Unknown"; break;
201 case VFT_APP
: p1
= "Application"; break;
202 case VFT_DLL
: p1
= "DLL"; break;
203 case VFT_DRV
: p1
= "Driver"; break;
204 case VFT_FONT
: p1
= "Font"; break;
205 case VFT_VXD
: p1
= "VxD"; break;
206 case VFT_STATIC_LIB
: p1
= "Static Library"; break;
207 default: p1
= "---"; break;
209 printf(" dwFileType: %s\n", p1
);
210 printf(" dwFileSubtype: %u\n", (UINT
)mm
->VersionInfo
.dwFileSubtype
);
211 printf(" dwFileDate: %x%08x\n",
212 (UINT
)mm
->VersionInfo
.dwFileDateMS
, (UINT
)mm
->VersionInfo
.dwFileDateLS
);
213 printf(" CvRecord: <%u>\n", (UINT
)mm
->CvRecord
.DataSize
);
214 dump_mdmp_data(&mm
->CvRecord
, " ");
215 printf(" MiscRecord: <%u>\n", (UINT
)mm
->MiscRecord
.DataSize
);
216 dump_mdmp_data(&mm
->MiscRecord
, " ");
217 print_longlong(" Reserved0", mm
->Reserved0
);
218 print_longlong(" Reserved1", mm
->Reserved1
);
222 case MemoryListStream
:
224 const MINIDUMP_MEMORY_LIST
*mml
= stream
;
225 const MINIDUMP_MEMORY_DESCRIPTOR
* mmd
= mml
->MemoryRanges
;
227 printf("Memory Ranges: %u\n", mml
->NumberOfMemoryRanges
);
228 for (i
= 0; i
< mml
->NumberOfMemoryRanges
; i
++, mmd
++)
230 printf(" Memory Range #%d:\n", i
);
231 print_longlong_range(" Range", mmd
->StartOfMemoryRange
, mmd
->Memory
.DataSize
);
232 dump_mdmp_data(&mmd
->Memory
, " ");
236 case SystemInfoStream
:
238 const MINIDUMP_SYSTEM_INFO
*msi
= stream
;
242 printf("System Information:\n");
243 switch (msi
->ProcessorArchitecture
)
245 case PROCESSOR_ARCHITECTURE_UNKNOWN
:
248 case PROCESSOR_ARCHITECTURE_INTEL
:
249 strcpy(tmp
, "Intel ");
250 switch (msi
->ProcessorLevel
)
252 case 3: str
= "80386"; break;
253 case 4: str
= "80486"; break;
254 case 5: str
= "Pentium"; break;
255 case 6: str
= "Pentium Pro/II or AMD Athlon"; break;
256 case 15: str
= "Pentium 4 or AMD Athlon64"; break;
257 default: str
= "???"; break;
261 if (msi
->ProcessorLevel
== 3 || msi
->ProcessorLevel
== 4)
263 if (HIBYTE(msi
->ProcessorRevision
) == 0xFF)
264 sprintf(tmp
+ strlen(tmp
), "%c%d", 'A' + ((msi
->ProcessorRevision
>>4)&0xf)-0x0a, msi
->ProcessorRevision
&0xf);
266 sprintf(tmp
+ strlen(tmp
), "%c%d", 'A' + HIBYTE(msi
->ProcessorRevision
), LOBYTE(msi
->ProcessorRevision
));
268 else sprintf(tmp
+ strlen(tmp
), "%d.%d", HIBYTE(msi
->ProcessorRevision
), LOBYTE(msi
->ProcessorRevision
));
271 case PROCESSOR_ARCHITECTURE_MIPS
:
274 case PROCESSOR_ARCHITECTURE_ALPHA
:
277 case PROCESSOR_ARCHITECTURE_PPC
:
280 case PROCESSOR_ARCHITECTURE_ARM
:
283 case PROCESSOR_ARCHITECTURE_ARM64
:
286 case PROCESSOR_ARCHITECTURE_AMD64
:
289 case PROCESSOR_ARCHITECTURE_MSIL
:
292 case PROCESSOR_ARCHITECTURE_NEUTRAL
:
299 printf(" Processor: %s (#%d CPUs)\n", str
, msi
->NumberOfProcessors
);
300 switch (msi
->MajorVersion
)
303 switch (msi
->MinorVersion
)
305 case 51: str
= "NT 3.51"; break;
306 default: str
= "3-????"; break;
310 switch (msi
->MinorVersion
)
312 case 0: str
= (msi
->PlatformId
== VER_PLATFORM_WIN32_NT
) ? "NT 4.0" : "95"; break;
313 case 10: str
= "98"; break;
314 case 90: str
= "ME"; break;
315 default: str
= "4-????"; break;
319 switch (msi
->MinorVersion
)
321 case 0: str
= "2000"; break;
322 case 1: str
= "XP"; break;
324 if (msi
->ProductType
== 1) str
= "XP";
325 else if (msi
->ProductType
== 3) str
= "Server 2003";
328 default: str
= "5-????"; break;
332 switch (msi
->MinorVersion
)
335 if (msi
->ProductType
== 1) str
= "Vista";
336 else if (msi
->ProductType
== 3) str
= "Server 2008";
340 if (msi
->ProductType
== 1) str
= "Win7";
341 else if (msi
->ProductType
== 3) str
= "Server 2008 R2";
345 if (msi
->ProductType
== 1) str
= "Win8";
346 else if (msi
->ProductType
== 3) str
= "Server 2012";
350 if (msi
->ProductType
== 1) str
= "Win8.1";
351 else if (msi
->ProductType
== 3) str
= "Server 2012 R2";
354 default: str
= "6-????"; break;
358 switch (msi
->MinorVersion
)
361 if (msi
->ProductType
== 1) str
= "Win10";
362 else str
= "10-????";
364 default: str
= "10-????"; break;
367 default: str
= "???"; break;
369 printf(" Version: Windows %s (%u)\n", str
, msi
->BuildNumber
);
370 printf(" PlatformId: %u\n", msi
->PlatformId
);
372 dump_mdmp_string(msi
->CSDVersionRva
);
374 printf(" Reserved1: %u\n", msi
->Reserved1
);
375 if (msi
->ProcessorArchitecture
== PROCESSOR_ARCHITECTURE_INTEL
)
377 printf(" x86.VendorId: %.12s\n",
378 (const char*)msi
->Cpu
.X86CpuInfo
.VendorId
);
379 printf(" x86.VersionInformation: %x\n", msi
->Cpu
.X86CpuInfo
.VersionInformation
);
380 printf(" x86.FeatureInformation: %x\n", msi
->Cpu
.X86CpuInfo
.FeatureInformation
);
381 printf(" x86.AMDExtendedCpuFeatures: %x\n", msi
->Cpu
.X86CpuInfo
.AMDExtendedCpuFeatures
);
383 if (sizeof(MINIDUMP_SYSTEM_INFO
) + 4 > dir
->Location
.DataSize
&&
384 msi
->CSDVersionRva
>= dir
->Location
.Rva
+ 4)
386 const char* code
= PRD(dir
->Location
.Rva
+ sizeof(MINIDUMP_SYSTEM_INFO
), 4);
388 if (code
&& code
[0] == 'W' && code
[1] == 'I' && code
[2] == 'N' && code
[3] == 'E' &&
389 *(wes
= (const DWORD
*)(code
+= 4)) >= 3)
391 /* assume we have wine extensions */
392 printf(" Wine details:\n");
393 printf(" build-id: %s\n", code
+ wes
[1]);
394 printf(" system: %s\n", code
+ wes
[2]);
395 printf(" release: %s\n", code
+ wes
[3]);
402 const MINIDUMP_MISC_INFO
*mmi
= stream
;
404 printf("Misc Information\n");
405 printf(" Size: %u\n", mmi
->SizeOfInfo
);
406 printf(" Flags: %#x\n", mmi
->Flags1
);
407 if (mmi
->Flags1
& MINIDUMP_MISC1_PROCESS_ID
)
408 printf(" ProcessId: %u\n", mmi
->ProcessId
);
409 if (mmi
->Flags1
& MINIDUMP_MISC1_PROCESS_TIMES
)
411 printf(" ProcessCreateTime: %s\n", get_time_str(mmi
->ProcessCreateTime
));
412 printf(" ProcessUserTime: %u\n", mmi
->ProcessUserTime
);
413 printf(" ProcessKernelTime: %u\n", mmi
->ProcessKernelTime
);
417 case ExceptionStream
:
419 const MINIDUMP_EXCEPTION_STREAM
*mes
= stream
;
421 printf("Exception:\n");
422 printf(" ThreadId: %#x\n", mes
->ThreadId
);
423 printf(" ExceptionRecord:\n");
424 printf(" ExceptionCode: %#x\n", mes
->ExceptionRecord
.ExceptionCode
);
425 printf(" ExceptionFlags: %#x\n", mes
->ExceptionRecord
.ExceptionFlags
);
426 print_longlong(" ExceptionRecord", mes
->ExceptionRecord
.ExceptionRecord
);
427 print_longlong(" ExceptionAddress", mes
->ExceptionRecord
.ExceptionAddress
);
428 printf(" ExceptionNumberParameters: %u\n", mes
->ExceptionRecord
.NumberParameters
);
429 for (i
= 0; i
< mes
->ExceptionRecord
.NumberParameters
; i
++)
432 print_longlong(" ", mes
->ExceptionRecord
.ExceptionInformation
[i
]);
434 printf(" ThreadContext:\n");
435 dump_mdmp_data(&mes
->ThreadContext
, " ");
438 case HandleDataStream
:
440 const MINIDUMP_HANDLE_DATA_STREAM
*mhd
= stream
;
442 printf("Handle data:\n");
443 printf(" SizeOfHeader: %u\n", mhd
->SizeOfHeader
);
444 printf(" SizeOfDescriptor: %u\n", mhd
->SizeOfDescriptor
);
445 printf(" NumberOfDescriptors: %u\n", mhd
->NumberOfDescriptors
);
447 ptr
= (BYTE
*)mhd
+ sizeof(*mhd
);
448 for (i
= 0; i
< mhd
->NumberOfDescriptors
; ++i
)
450 const MINIDUMP_HANDLE_DESCRIPTOR_2
*hd
= (void *)ptr
;
452 printf(" Handle [%u]:\n", i
);
453 print_longlong(" Handle", hd
->Handle
);
454 printf(" TypeName: ");
455 dump_mdmp_string(hd
->TypeNameRva
);
457 printf(" ObjectName: ");
458 dump_mdmp_string(hd
->ObjectNameRva
);
460 printf(" Attributes: %#x\n", hd
->Attributes
);
461 printf(" GrantedAccess: %#x\n", hd
->GrantedAccess
);
462 printf(" HandleCount: %u\n", hd
->HandleCount
);
463 printf(" PointerCount: %#x\n", hd
->PointerCount
);
465 if (mhd
->SizeOfDescriptor
>= sizeof(MINIDUMP_HANDLE_DESCRIPTOR_2
))
467 printf(" ObjectInfo: ");
468 dump_mdmp_string(hd
->ObjectInfoRva
);
470 printf(" Reserved0: %#x\n", hd
->Reserved0
);
473 ptr
+= mhd
->SizeOfDescriptor
;
477 case ThreadInfoListStream
:
479 const MINIDUMP_THREAD_INFO_LIST
*til
= stream
;
481 printf("Thread Info List:\n");
482 printf(" SizeOfHeader: %u\n", (UINT
)til
->SizeOfHeader
);
483 printf(" SizeOfEntry: %u\n", (UINT
)til
->SizeOfEntry
);
484 printf(" NumberOfEntries: %u\n", (UINT
)til
->NumberOfEntries
);
486 ptr
= (BYTE
*)til
+ sizeof(*til
);
487 for (i
= 0; i
< til
->NumberOfEntries
; ++i
)
489 const MINIDUMP_THREAD_INFO
*ti
= (void *)ptr
;
491 printf(" Thread [%u]:\n", i
);
492 printf(" ThreadId: %u\n", ti
->ThreadId
);
493 printf(" DumpFlags: %#x\n", ti
->DumpFlags
);
494 printf(" DumpError: %u\n", ti
->DumpError
);
495 printf(" ExitStatus: %u\n", ti
->ExitStatus
);
496 print_longlong(" CreateTime", ti
->CreateTime
);
497 print_longlong(" ExitTime", ti
->ExitTime
);
498 print_longlong(" KernelTime", ti
->KernelTime
);
499 print_longlong(" UserTime", ti
->UserTime
);
500 print_longlong(" StartAddress", ti
->StartAddress
);
501 print_longlong(" Affinity", ti
->Affinity
);
503 ptr
+= til
->SizeOfEntry
;
508 case UnloadedModuleListStream
:
510 const MINIDUMP_UNLOADED_MODULE_LIST
*uml
= stream
;
512 printf("Unloaded module list:\n");
513 printf(" SizeOfHeader: %u\n", uml
->SizeOfHeader
);
514 printf(" SizeOfEntry: %u\n", uml
->SizeOfEntry
);
515 printf(" NumberOfEntries: %u\n", uml
->NumberOfEntries
);
517 ptr
= (BYTE
*)uml
+ sizeof(*uml
);
518 for (i
= 0; i
< uml
->NumberOfEntries
; ++i
)
520 const MINIDUMP_UNLOADED_MODULE
*mod
= (void *)ptr
;
522 printf(" Module [%u]:\n", i
);
523 print_longlong(" BaseOfImage", mod
->BaseOfImage
);
524 printf(" SizeOfImage: %u\n", mod
->SizeOfImage
);
525 printf(" CheckSum: %#x\n", mod
->CheckSum
);
526 printf(" TimeDateStamp: %s\n", get_time_str(mod
->TimeDateStamp
));
527 printf(" ModuleName: ");
528 dump_mdmp_string(mod
->ModuleNameRva
);
531 ptr
+= uml
->SizeOfEntry
;
537 printf("NIY %d\n", dir
->StreamType
);
538 printf(" RVA: %u\n", (UINT
)dir
->Location
.Rva
);
539 printf(" Size: %u\n", dir
->Location
.DataSize
);
540 dump_mdmp_data(&dir
->Location
, " ");