winapi - What API does Task Manager use to Dump a process -
Can anyone tell me what Windows Inbuilt Task Manager dumps to choose the process?
If I am right then this is not a minidamprite dump, if it is not so, what? Thanks a lot!
A short answer, it uses Description (Some unnecessary details were omitted): In the Windows 7 version, the Task Manager executable has some cover function called with the process ID and executable name. Is, like This handles the process by using Set using MiniDumpWriteDump .
Foo.exe , whenever you want to dump a process.
OpenProcess and stores it in some structure allocated in the heap by using
HeapAlloc < P> This obtains a temporary directory in some local variables by using the
GetTempPathW , for example the executable name, such as
foo.exe ,
PathAppendW Using and delete
foo without
.exe extensions by using
PathRemoveExtension and then add a To find out if the path has not been used, use the new extension or
foo (2) such as
PathAddExtensionW , and call
PathYetAnotherMakeUniqueName Generate a new path. DP . Finally,
CreateFile .
MiniDumpWriteDump DumpType using thread calls
0x1826 :
minidumpwatflameman | MiniDampHandHandleData | Minimal Thread Thumbnail Modules | MiniDampWithFullMarineFFO | MiniDumpWithThreadInfo
Comments
Post a Comment