2 * MiniDump dumping utility
4 * Copyright 2005 Eric Pouech
6 * This library is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU Lesser General Public
8 * License as published by the Free Software Foundation; either
9 * version 2.1 of the License, or (at your option) any later version.
11 * This library is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 * Lesser General Public License for more details.
16 * You should have received a copy of the GNU Lesser General Public
17 * License along with this library; if not, write to the Free Software
18 * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
28 static void dump_mdmp_data(const MINIDUMP_LOCATION_DESCRIPTOR
* md
, const char* pfx
)
31 dump_data(PRD(md
->Rva
, md
->DataSize
), md
->DataSize
, pfx
);
34 static void dump_mdmp_string(DWORD rva
)
36 const MINIDUMP_STRING
* ms
= PRD(rva
, sizeof(MINIDUMP_STRING
));
40 dump_unicode_str( ms
->Buffer
, ms
->Length
/ sizeof(WCHAR
) );
45 enum FileSig
get_kind_mdmp(void)
49 pdw
= PRD(0, sizeof(DWORD
));
50 if (!pdw
) {printf("Can't get main signature, aborting\n"); return SIG_UNKNOWN
;}
52 if (*pdw
== 0x504D444D /* "MDMP" */) return SIG_MDMP
;
56 static inline void print_longlong(const char *title
, ULONG64 value
)
58 printf("%s: 0x", title
);
59 if (sizeof(value
) > sizeof(unsigned long) && value
>> 32)
60 printf("%lx%08lx\n", (unsigned long)(value
>> 32), (unsigned long)value
);
62 printf("%lx\n", (unsigned long)value
);
65 static inline void print_longlong_range(const char *title
, ULONG64 start
, ULONG64 length
)
67 ULONG64 value
= start
;
68 printf("%s: 0x", title
);
69 if (sizeof(value
) > sizeof(unsigned long) && value
>> 32)
70 printf("%lx%08lx-", (unsigned long)(value
>> 32), (unsigned long)value
);
72 printf("%lx-", (unsigned long)value
);
73 value
= start
+ length
;
74 if (sizeof(value
) > sizeof(unsigned long) && value
>> 32)
75 printf("0x%lx%08lx\n", (unsigned long)(value
>> 32), (unsigned long)value
);
77 printf("0x%lx\n", (unsigned long)value
);
82 const MINIDUMP_HEADER
* hdr
= PRD(0, sizeof(MINIDUMP_HEADER
));
83 const MINIDUMP_DIRECTORY
* dir
;
89 printf("Cannot get Minidump header\n");
93 printf("Signature: %#x (%.4s)\n", hdr
->Signature
, (const char*)&hdr
->Signature
);
94 printf("Version: %#x\n", hdr
->Version
);
95 printf("NumberOfStreams: %u\n", hdr
->NumberOfStreams
);
96 printf("StreamDirectoryRva: %u\n", (UINT
)hdr
->StreamDirectoryRva
);
97 printf("CheckSum: %u\n", hdr
->CheckSum
);
98 printf("TimeDateStamp: %s\n", get_time_str(hdr
->TimeDateStamp
));
99 print_longlong("Flags", hdr
->Flags
);
101 for (idx
= 0; idx
< hdr
->NumberOfStreams
; ++idx
)
103 dir
= PRD(hdr
->StreamDirectoryRva
+ idx
* sizeof(MINIDUMP_DIRECTORY
), sizeof(*dir
));
106 stream
= PRD(dir
->Location
.Rva
, dir
->Location
.DataSize
);
108 printf("Stream [%u]: ", idx
);
109 switch (dir
->StreamType
)
111 case ThreadListStream
:
113 const MINIDUMP_THREAD_LIST
*mtl
= stream
;
114 const MINIDUMP_THREAD
*mt
= mtl
->Threads
;
116 printf("Threads: %u\n", (UINT
)mtl
->NumberOfThreads
);
117 for (i
= 0; i
< mtl
->NumberOfThreads
; i
++, mt
++)
119 printf("Thread: #%d\n", i
);
120 printf(" ThreadId: %u\n", mt
->ThreadId
);
121 printf(" SuspendCount: %u\n", mt
->SuspendCount
);
122 printf(" PriorityClass: %u\n", mt
->PriorityClass
);
123 printf(" Priority: %u\n", mt
->Priority
);
124 print_longlong(" Teb", mt
->Teb
);
125 print_longlong_range(" Stack", mt
->Stack
.StartOfMemoryRange
, mt
->Stack
.Memory
.DataSize
);
126 dump_mdmp_data(&mt
->Stack
.Memory
, " ");
127 printf(" ThreadContext:\n");
128 dump_mdmp_data(&mt
->ThreadContext
, " ");
132 case ModuleListStream
:
135 const MINIDUMP_MODULE_LIST
*mml
= stream
;
136 const MINIDUMP_MODULE
* mm
= mml
->Modules
;
140 printf("Modules (%s): %u\n",
141 dir
->StreamType
== ModuleListStream
? "PE" : "ELF",
142 mml
->NumberOfModules
);
143 for (i
= 0; i
< mml
->NumberOfModules
; i
++, mm
++)
145 printf(" Module #%d:\n", i
);
146 print_longlong(" BaseOfImage", mm
->BaseOfImage
);
147 printf(" SizeOfImage: %u\n", mm
->SizeOfImage
);
148 printf(" CheckSum: %#x\n", mm
->CheckSum
);
149 printf(" TimeDateStamp: %s\n", get_time_str(mm
->TimeDateStamp
));
150 printf(" ModuleName: ");
151 dump_mdmp_string(mm
->ModuleNameRva
);
153 printf(" VersionInfo:\n");
154 printf(" dwSignature: %x\n", (UINT
)mm
->VersionInfo
.dwSignature
);
155 printf(" dwStrucVersion: %x\n", (UINT
)mm
->VersionInfo
.dwStrucVersion
);
156 printf(" dwFileVersion: %d,%d,%d,%d\n",
157 HIWORD(mm
->VersionInfo
.dwFileVersionMS
),
158 LOWORD(mm
->VersionInfo
.dwFileVersionMS
),
159 HIWORD(mm
->VersionInfo
.dwFileVersionLS
),
160 LOWORD(mm
->VersionInfo
.dwFileVersionLS
));
161 printf(" dwProductVersion %d,%d,%d,%d\n",
162 HIWORD(mm
->VersionInfo
.dwProductVersionMS
),
163 LOWORD(mm
->VersionInfo
.dwProductVersionMS
),
164 HIWORD(mm
->VersionInfo
.dwProductVersionLS
),
165 LOWORD(mm
->VersionInfo
.dwProductVersionLS
));
166 printf(" dwFileFlagsMask: %u\n", (UINT
)mm
->VersionInfo
.dwFileFlagsMask
);
167 printf(" dwFileFlags: %s%s%s%s%s%s\n",
168 mm
->VersionInfo
.dwFileFlags
& VS_FF_DEBUG
? "Debug " : "",
169 mm
->VersionInfo
.dwFileFlags
& VS_FF_INFOINFERRED
? "Inferred " : "",
170 mm
->VersionInfo
.dwFileFlags
& VS_FF_PATCHED
? "Patched " : "",
171 mm
->VersionInfo
.dwFileFlags
& VS_FF_PRERELEASE
? "PreRelease " : "",
172 mm
->VersionInfo
.dwFileFlags
& VS_FF_PRIVATEBUILD
? "PrivateBuild " : "",
173 mm
->VersionInfo
.dwFileFlags
& VS_FF_SPECIALBUILD
? "SpecialBuild " : "");
174 if (mm
->VersionInfo
.dwFileOS
)
176 switch (mm
->VersionInfo
.dwFileOS
& 0x000F)
178 case VOS__BASE
: p1
= "_base"; break;
179 case VOS__WINDOWS16
:p1
= "16 bit Windows"; break;
180 case VOS__PM16
: p1
= "16 bit Presentation Manager"; break;
181 case VOS__PM32
: p1
= "32 bit Presentation Manager"; break;
182 case VOS__WINDOWS32
:p1
= "32 bit Windows"; break;
183 default: p1
= "---"; break;
185 switch (mm
->VersionInfo
.dwFileOS
& 0xF0000)
187 case VOS_UNKNOWN
: p2
= "unknown"; break;
188 case VOS_DOS
: p2
= "DOS"; break;
189 case VOS_OS216
: p2
= "16 bit OS/2"; break;
190 case VOS_OS232
: p2
= "32 bit OS/2"; break;
191 case VOS_NT
: p2
= "Windows NT"; break;
192 default: p2
= "---"; break;
194 printf(" dwFileOS: %s running on %s\n", p1
, p2
);
196 else printf(" dwFileOS: 0\n");
197 switch (mm
->VersionInfo
.dwFileType
)
199 case VFT_UNKNOWN
: p1
= "Unknown"; break;
200 case VFT_APP
: p1
= "Application"; break;
201 case VFT_DLL
: p1
= "DLL"; break;
202 case VFT_DRV
: p1
= "Driver"; break;
203 case VFT_FONT
: p1
= "Font"; break;
204 case VFT_VXD
: p1
= "VxD"; break;
205 case VFT_STATIC_LIB
: p1
= "Static Library"; break;
206 default: p1
= "---"; break;
208 printf(" dwFileType: %s\n", p1
);
209 printf(" dwFileSubtype: %u\n", (UINT
)mm
->VersionInfo
.dwFileSubtype
);
210 printf(" dwFileDate: %x%08x\n",
211 (UINT
)mm
->VersionInfo
.dwFileDateMS
, (UINT
)mm
->VersionInfo
.dwFileDateLS
);
212 printf(" CvRecord: <%u>\n", (UINT
)mm
->CvRecord
.DataSize
);
213 dump_mdmp_data(&mm
->CvRecord
, " ");
214 printf(" MiscRecord: <%u>\n", (UINT
)mm
->MiscRecord
.DataSize
);
215 dump_mdmp_data(&mm
->MiscRecord
, " ");
216 printf(" Reserved0: 0x%x%08x\n",
217 (UINT
)(mm
->Reserved0
>> 32), (UINT
)mm
->Reserved0
);
218 printf(" Reserved1: 0x%x%08x\n",
219 (UINT
)(mm
->Reserved1
>> 32), (UINT
)mm
->Reserved1
);
223 case MemoryListStream
:
225 const MINIDUMP_MEMORY_LIST
*mml
= stream
;
226 const MINIDUMP_MEMORY_DESCRIPTOR
* mmd
= mml
->MemoryRanges
;
228 printf("Memory Ranges: %u\n", mml
->NumberOfMemoryRanges
);
229 for (i
= 0; i
< mml
->NumberOfMemoryRanges
; i
++, mmd
++)
231 printf(" Memory Range #%d:\n", i
);
232 print_longlong_range(" Range", mmd
->StartOfMemoryRange
, mmd
->Memory
.DataSize
);
233 dump_mdmp_data(&mmd
->Memory
, " ");
237 case SystemInfoStream
:
239 const MINIDUMP_SYSTEM_INFO
*msi
= stream
;
243 printf("System Information:\n");
244 switch (msi
->ProcessorArchitecture
)
246 case PROCESSOR_ARCHITECTURE_UNKNOWN
:
249 case PROCESSOR_ARCHITECTURE_INTEL
:
250 strcpy(tmp
, "Intel ");
251 switch (msi
->ProcessorLevel
)
253 case 3: str
= "80386"; break;
254 case 4: str
= "80486"; break;
255 case 5: str
= "Pentium"; break;
256 case 6: str
= "Pentium Pro/II or AMD Athlon"; break;
257 case 15: str
= "Pentium 4 or AMD Athlon64"; break;
258 default: str
= "???"; break;
262 if (msi
->ProcessorLevel
== 3 || msi
->ProcessorLevel
== 4)
264 if (HIBYTE(msi
->ProcessorRevision
) == 0xFF)
265 sprintf(tmp
+ strlen(tmp
), "%c%d", 'A' + ((msi
->ProcessorRevision
>>4)&0xf)-0x0a, msi
->ProcessorRevision
&0xf);
267 sprintf(tmp
+ strlen(tmp
), "%c%d", 'A' + HIBYTE(msi
->ProcessorRevision
), LOBYTE(msi
->ProcessorRevision
));
269 else sprintf(tmp
+ strlen(tmp
), "%d.%d", HIBYTE(msi
->ProcessorRevision
), LOBYTE(msi
->ProcessorRevision
));
272 case PROCESSOR_ARCHITECTURE_MIPS
:
275 case PROCESSOR_ARCHITECTURE_ALPHA
:
278 case PROCESSOR_ARCHITECTURE_PPC
:
281 case PROCESSOR_ARCHITECTURE_ARM
:
284 case PROCESSOR_ARCHITECTURE_ARM64
:
287 case PROCESSOR_ARCHITECTURE_AMD64
:
290 case PROCESSOR_ARCHITECTURE_MSIL
:
293 case PROCESSOR_ARCHITECTURE_NEUTRAL
:
300 printf(" Processor: %s (#%d CPUs)\n", str
, msi
->NumberOfProcessors
);
301 switch (msi
->MajorVersion
)
304 switch (msi
->MinorVersion
)
306 case 51: str
= "NT 3.51"; break;
307 default: str
= "3-????"; break;
311 switch (msi
->MinorVersion
)
313 case 0: str
= (msi
->PlatformId
== VER_PLATFORM_WIN32_NT
) ? "NT 4.0" : "95"; break;
314 case 10: str
= "98"; break;
315 case 90: str
= "ME"; break;
316 default: str
= "4-????"; break;
320 switch (msi
->MinorVersion
)
322 case 0: str
= "2000"; break;
323 case 1: str
= "XP"; break;
325 if (msi
->ProductType
== 1) str
= "XP";
326 else if (msi
->ProductType
== 3) str
= "Server 2003";
329 default: str
= "5-????"; break;
333 switch (msi
->MinorVersion
)
336 if (msi
->ProductType
== 1) str
= "Vista";
337 else if (msi
->ProductType
== 3) str
= "Server 2008";
341 if (msi
->ProductType
== 1) str
= "Win7";
342 else if (msi
->ProductType
== 3) str
= "Server 2008 R2";
346 if (msi
->ProductType
== 1) str
= "Win8";
347 else if (msi
->ProductType
== 3) str
= "Server 2012";
351 if (msi
->ProductType
== 1) str
= "Win8.1";
352 else if (msi
->ProductType
== 3) str
= "Server 2012 R2";
355 default: str
= "6-????"; break;
359 switch (msi
->MinorVersion
)
362 if (msi
->ProductType
== 1) str
= "Win10";
363 else str
= "10-????";
365 default: str
= "10-????"; break;
368 default: str
= "???"; break;
370 printf(" Version: Windows %s (%u)\n", str
, msi
->BuildNumber
);
371 printf(" PlatformId: %u\n", msi
->PlatformId
);
373 dump_mdmp_string(msi
->CSDVersionRva
);
375 printf(" Reserved1: %u\n", msi
->Reserved1
);
376 if (msi
->ProcessorArchitecture
== PROCESSOR_ARCHITECTURE_INTEL
)
378 printf(" x86.VendorId: %.12s\n",
379 (const char*)msi
->Cpu
.X86CpuInfo
.VendorId
);
380 printf(" x86.VersionInformation: %x\n", msi
->Cpu
.X86CpuInfo
.VersionInformation
);
381 printf(" x86.FeatureInformation: %x\n", msi
->Cpu
.X86CpuInfo
.FeatureInformation
);
382 printf(" x86.AMDExtendedCpuFeatures: %x\n", msi
->Cpu
.X86CpuInfo
.AMDExtendedCpuFeatures
);
384 if (sizeof(MINIDUMP_SYSTEM_INFO
) + 4 > dir
->Location
.DataSize
&&
385 msi
->CSDVersionRva
>= dir
->Location
.Rva
+ 4)
387 const char* code
= PRD(dir
->Location
.Rva
+ sizeof(MINIDUMP_SYSTEM_INFO
), 4);
389 if (code
&& code
[0] == 'W' && code
[1] == 'I' && code
[2] == 'N' && code
[3] == 'E' &&
390 *(wes
= (const DWORD
*)(code
+= 4)) >= 3)
392 /* assume we have wine extensions */
393 printf(" Wine details:\n");
394 printf(" build-id: %s\n", code
+ wes
[1]);
395 printf(" system: %s\n", code
+ wes
[2]);
396 printf(" release: %s\n", code
+ wes
[3]);
403 const MINIDUMP_MISC_INFO
*mmi
= stream
;
405 printf("Misc Information\n");
406 printf(" Size: %u\n", mmi
->SizeOfInfo
);
407 printf(" Flags: %#x\n", mmi
->Flags1
);
408 if (mmi
->Flags1
& MINIDUMP_MISC1_PROCESS_ID
)
409 printf(" ProcessId: %u\n", mmi
->ProcessId
);
410 if (mmi
->Flags1
& MINIDUMP_MISC1_PROCESS_TIMES
)
412 printf(" ProcessCreateTime: %s\n", get_time_str(mmi
->ProcessCreateTime
));
413 printf(" ProcessUserTime: %u\n", mmi
->ProcessUserTime
);
414 printf(" ProcessKernelTime: %u\n", mmi
->ProcessKernelTime
);
418 case ExceptionStream
:
420 const MINIDUMP_EXCEPTION_STREAM
*mes
= stream
;
422 printf("Exception:\n");
423 printf(" ThreadId: %#x\n", mes
->ThreadId
);
424 printf(" ExceptionRecord:\n");
425 printf(" ExceptionCode: %#x\n", mes
->ExceptionRecord
.ExceptionCode
);
426 printf(" ExceptionFlags: %#x\n", mes
->ExceptionRecord
.ExceptionFlags
);
427 print_longlong(" ExceptionRecord", mes
->ExceptionRecord
.ExceptionRecord
);
428 print_longlong(" ExceptionAddress", mes
->ExceptionRecord
.ExceptionAddress
);
429 printf(" ExceptionNumberParameters: %u\n", mes
->ExceptionRecord
.NumberParameters
);
430 for (i
= 0; i
< mes
->ExceptionRecord
.NumberParameters
; i
++)
433 print_longlong(" ", mes
->ExceptionRecord
.ExceptionInformation
[i
]);
435 printf(" ThreadContext:\n");
436 dump_mdmp_data(&mes
->ThreadContext
, " ");
439 case HandleDataStream
:
441 const MINIDUMP_HANDLE_DATA_STREAM
*mhd
= stream
;
444 printf("Handle data:\n");
445 printf(" SizeOfHeader: %u\n", mhd
->SizeOfHeader
);
446 printf(" SizeOfDescriptor: %u\n", mhd
->SizeOfDescriptor
);
447 printf(" NumberOfDescriptors: %u\n", mhd
->NumberOfDescriptors
);
449 desc
= (BYTE
*)mhd
+ sizeof(*mhd
);
450 for (i
= 0; i
< mhd
->NumberOfDescriptors
; ++i
)
452 const MINIDUMP_HANDLE_DESCRIPTOR_2
*hd
= (void *)desc
;
454 printf(" Handle [%u]:\n", i
);
455 print_longlong(" Handle", hd
->Handle
);
456 printf(" TypeName: ");
457 dump_mdmp_string(hd
->TypeNameRva
);
459 printf(" ObjectName: ");
460 dump_mdmp_string(hd
->ObjectNameRva
);
462 printf(" Attributes: %#x\n", hd
->Attributes
);
463 printf(" GrantedAccess: %#x\n", hd
->GrantedAccess
);
464 printf(" HandleCount: %u\n", hd
->HandleCount
);
465 printf(" PointerCount: %#x\n", hd
->PointerCount
);
467 if (mhd
->SizeOfDescriptor
>= sizeof(MINIDUMP_HANDLE_DESCRIPTOR_2
))
469 printf(" ObjectInfo: ");
470 dump_mdmp_string(hd
->ObjectInfoRva
);
472 printf(" Reserved0: %#x\n", hd
->Reserved0
);
475 desc
+= mhd
->SizeOfDescriptor
;
479 case ThreadInfoListStream
:
481 const MINIDUMP_THREAD_INFO_LIST
*til
= stream
;
484 printf("Thread Info List:\n");
485 printf(" SizeOfHeader: %u\n", (UINT
)til
->SizeOfHeader
);
486 printf(" SizeOfEntry: %u\n", (UINT
)til
->SizeOfEntry
);
487 printf(" NumberOfEntries: %u\n", (UINT
)til
->NumberOfEntries
);
489 desc
= (BYTE
*)til
+ sizeof(*til
);
490 for (i
= 0; i
< til
->NumberOfEntries
; ++i
)
492 const MINIDUMP_THREAD_INFO
*ti
= (void *)desc
;
494 printf(" Thread [%u]:\n", i
);
495 printf(" ThreadId: %u\n", ti
->ThreadId
);
496 printf(" DumpFlags: %#x\n", ti
->DumpFlags
);
497 printf(" DumpError: %u\n", ti
->DumpError
);
498 printf(" ExitStatus: %u\n", ti
->ExitStatus
);
499 print_longlong(" CreateTime", ti
->CreateTime
);
500 print_longlong(" ExitTime", ti
->ExitTime
);
501 print_longlong(" KernelTime", ti
->KernelTime
);
502 print_longlong(" UserTime", ti
->UserTime
);
503 print_longlong(" StartAddress", ti
->StartAddress
);
504 print_longlong(" Affinity", ti
->Affinity
);
506 desc
+= til
->SizeOfEntry
;
512 printf("NIY %d\n", dir
->StreamType
);
513 printf(" RVA: %u\n", (UINT
)dir
->Location
.Rva
);
514 printf(" Size: %u\n", dir
->Location
.DataSize
);
515 dump_mdmp_data(&dir
->Location
, " ");