Do not collect 32bit process' dumps with 64bit task manager

What is a dump file?

A dump file is a snapshot of a process' memory written on the disk. You can use a dump file to troubleshoot several issues including crashes, hangs and performance problems. Basically, you collect "crash dumps" if a process quits unexpectadly or "manual dumps" if there is a hang or performance issues with the process.

How to collect dumps

For crash dumps, you can configure a debugger, such as Debug Diagnostic Tool or ADPlus which ships with Debugging Tools For Windows, to capture dumps when a process crashes. For performance or hang issues, you need to collect hang dumps. A hang dump is also known as manual dump because you don't create a crash rule to capture for a spefic event (crash or first chance exceptions, etc...), instead you tell debugger to collect the dump at that time and the process is written to the disk.

A rule of thumb when collecting dump files is to use the correct version of the debugger which matches the architecture of the target process. For example, if your OS is 64bit and your target process which you would like to debug is 32bit then you need to use 32bit debugger, or, if you need to collect a dump of 64bit debugger, then you need to use 64bit debugger. If you collect a dump using wrong debugger version then you will probably see unreasonable callstacks when you try to debug your process in WinDBG and probably you will waste your time.

Task Manager as a way for collecting dumps

Starting with Vista (of course Win 7 and Win Server 2008 also supports) operating system, you can collect a process' dump using task manager. Most of the time collecting dumps using task manager is the easiest way to capture dumps because you just right click on a process name and choose "Create Dump File". Please see the sample screenshot below:

Collect correct dumps using the correct version of the Task Manager

The rule I mentioned above also applies to the task manager. So, you need to use 32bit debugger, if you would like to collect a dump of a 32bit process. So, if your process is 32bit, then you need to run 32bit version of the task manager on a 64bit OS. 32bit task manager is located in C:\Windows\SysWOW64 folder and the name of the file is taskmgr.exe.

How to understand if a process is 32bit or 64bit

If you do not know how to figure out if a process is 32bit on a 64bit OS, then open a task manager (either 32bit or 64bit) and then check the process name. If you see *32 near your process name, then it is a 32bit process.

Happy debugging...