winapi - What API does Task Manager use to Dump a process -
Can anyone tell me what Windows Inbuilt Task Manager dumps to choose the process?
If I am right then this is not a minidamprite dump, if it is not so, what? Thanks a lot!
A short answer, it uses Description (Some unnecessary details were omitted): In the Windows 7 version, the Task Manager executable has some cover function called with the process ID and executable name. Is, like This handles the process by using Set using MiniDumpWriteDump . Foo.exe , whenever you want to dump a process. OpenProcess and stores it in some structure allocated in the heap by using HeapAlloc < P> This obtains a temporary directory in some local variables by using the GetTempPathW , for example the executable name, such as foo.exe , PathAppendW Using and delete foo without .exe extensions by using PathRemoveExtension and then add a To find out if the path has not been used, use the new extension or foo (2) such as PathAddExtensionW , and call PathYetAnotherMakeUniqueName Generate a new path. DP . Finally, CreateFile . MiniDumpWriteDump DumpType using thread calls 0x1826 :
minidumpwatflameman | MiniDampHandHandleData | Minimal Thread Thumbnail Modules | MiniDampWithFullMarineFFO | MiniDumpWithThreadInfo
Comments
Post a Comment