MiniDumpWriteDump : Object partially in memory

Ludovic Mainguy 1 Reputation point
2021-01-18T16:12:59.507+00:00

Hi,
Our team is using __try/__except in conjunction with MiniDumpWriteDump to create minidumps when a thread crashes.
The callstack contained in the minidump is correctly decoded. The this pointer of the crashing function seems to be ok.

But for some reason the memory of the object is only partially saved in the minidump.
For example, an object with a size of 2300 bytes would have only the 330 bytes saved in the minidump.
After that, the debugger would only show "Unable to read memory".

What could cause this ? I suspect it is related to our memory allocation logic.
What is the logic of memory saving when MiniDumpWriteDump is called ?
Thanks for your help,
Ludovic

Windows API - Win32
Windows API - Win32
A core set of Windows application programming interfaces (APIs) for desktop and server applications. Previously known as Win32 API.
2,430 questions
C++
C++
A high-level, general-purpose programming language, created as an extension of the C programming language, that has object-oriented, generic, and functional features in addition to facilities for low-level memory manipulation.
3,545 questions

3 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. RLWA32 40,851 Reputation points
    2021-01-18T17:20:12.39+00:00

    The documentations for MiniDumpWriteDump suggests "MiniDumpWriteDump should be called from a separate process if at all possible, rather than from within the target process being dumped. This is especially true when the target process is already not stable. For example, if it just crashed."

    Have you tried using Microsoft's Procdump?

    0 comments
  2. Ludovic Mainguy 1 Reputation point
    2021-01-18T19:24:17.327+00:00

    That's what I thought too, but the problem also happens when the minidump is written by a separate process.

    That said, for simple crashes like the one I triggered, MiniDumpWriteDump works usually pretty well if it is called from a different thread.
    At least from my past experience.

    I did not know about Procdump, I'll try it, thanks.

  3. Fei Xue - MSFT 1,111 Reputation points
    2021-03-03T01:40:52.107+00:00

    You can try use MiniDumpWithFullMemory instead of MiniDumpWithIndirectlyReferencedMemory as MiniDumpWithIndirectlyReferencedMemory will only add 1024 bytes of memory around any memory pointer to the mini dump.

    And here is a nice 3rd descriptive blog on the MiniDumpWriteDump function:
    DebugInfo.com - Effective minidumps (MiniDumpWriteDump, MiniDumpCallback).

    Disclaimer: This response contains a reference to a third party World Wide Web site. Microsoft is providing this information as a convenience to you. Microsoft does not control these sites and has not tested any software or information found on these sites; therefore, Microsoft cannot make any representations regarding the quality, safety, or suitability of any software or information found there. There are inherent dangers in the use of any software found on the Internet, and Microsoft cautions you to make sure that you completely understand the risk before retrieving any software from the Internet.