winapi - What API does Task Manager use to Dump a process -


Can anyone tell me what Windows Inbuilt Task Manager dumps to choose the process?

If I am right then this is not a minidamprite dump, if it is not so, what? Thanks a lot!

A short answer, it uses MiniDumpWriteDump .

Description (Some unnecessary details were omitted):

In the Windows 7 version, the Task Manager executable has some cover function called with the process ID and executable name. Is, like Foo.exe , whenever you want to dump a process.

This handles the process by using OpenProcess and stores it in some structure allocated in the heap by using HeapAlloc < P> This obtains a temporary directory in some local variables by using the GetTempPathW , for example the executable name, such as foo.exe , PathAppendW Using and delete foo without .exe extensions by using PathRemoveExtension and then add a To find out if the path has not been used, use the new extension or foo (2) such as PathAddExtensionW , and call PathYetAnotherMakeUniqueName Generate a new path. DP . Finally, CreateFile .

Set using MiniDumpWriteDump DumpType using thread calls 0x1826 :

  minidumpwatflameman | MiniDampHandHandleData | Minimal Thread Thumbnail Modules | MiniDampWithFullMarineFFO | MiniDumpWithThreadInfo    

Comments

Popular posts from this blog

ios - Adding an SKSpriteNode to SKScene from a child SKSpriteNode -

Matlab transpose a table vector -

c# - Textbox not clickable but editable -