process Exploror抓到的dmp包含多少程序信息

[张亚成]

当程序挂掉的时候，使用process Exploror抓到的dmp文件，文件包含的内容是当前内存中保存的一段关于程序的信息吗？
大概保存多少信息？是内存中开辟的临时区域的大小？

[赵4老师]

ms-help://MS.VSCC.v90/MS.MSDNQTR.v90.chs/debug/base/dbghelp_functions.htm DbgHelp Functions The following are the DbgHelp functions. General The following are general helper functions: EnumDirTree ImagehlpApiVersion ImagehlpApiVersionEx MakeSureDirectoryPathExists SearchTreeForFile Debugger The debugging service functions are the functions most suited for use by a debugger or the debugging code in an application. These functions can be used in concert with the symbol handler functions for easier use. EnumerateLoadedModules64 EnumerateLoadedModulesEx FindDebugInfoFile FindDebugInfoFileEx FindExecutableImage FindExecutableImageEx StackWalk64 SymSetParentWindow UnDecorateSymbolName Image Access The image access functions access the data in an executable image. The functions provide high-level access to the base of images and very specific access to the most common parts of an image's data. GetTimestampForLoadedLibrary ImageDirectoryEntryToData ImageDirectoryEntryToDataEx ImageNtHeader ImageRvaToSection ImageRvaToVa Symbol Handler The symbol handler functions give applications easy and portable access to the symbolic debugging information of an image. These functions should be used exclusively to ensure access to symbolic information. This is necessary because these functions isolate the application from the symbol format. SymAddSymbol SymCleanup SymDeleteSymbol SymEnumerateModules64 SymEnumLines SymEnumProcesses SymEnumSourceFiles SymEnumSourceFileTokens SymEnumSourceLines SymEnumSymbols SymEnumSymbolsForAddr SymEnumTypes SymEnumTypesByName SymFindDebugInfoFile SymFindExecutableImage SymFindFileInPath SymFromAddr SymFromIndex SymFromName SymFromToken SymFunctionTableAccess64 SymGetFileLineOffsets64 SymGetHomeDirectory SymGetLineFromAddr64 SymGetLineFromName64 SymGetLineNext64 SymGetLinePrev64 SymGetModuleBase64 SymGetModuleInfo64 SymGetOptions SymGetScope SymGetSearchPath SymGetSymbolFile SymGetTypeFromName SymGetTypeInfo SymGetTypeInfoEx SymGetUnwindInfo SymInitialize SymLoadModule64 SymLoadModuleEx SymMatchFileName SymMatchString SymNext SymPrev SymRefreshModuleList SymRegisterCallback64 SymRegisterFunctionEntryCallback64 SymSearch SymSetContext SymSetHomeDirectory SymSetOptions SymSetScopeFromAddr SymSetScopeFromIndex SymSetSearchPath SymUnDName64 SymUnloadModule64 Symbol Server The symbol server enables debuggers to automatically retrieve the correct symbol files without product names, releases, or build numbers. The following functions are used with the symbol server. SymbolServer SymbolServerClose SymbolServerGetOptions SymbolServerSetOptions SymSrvDeltaName SymSrvGetFileIndexes SymSrvGetFileIndexInfo SymSrvGetFileIndexString SymSrvGetSupplement SymSrvIsStore SymSrvStoreFile SymSrvStoreSupplement User-mode Minidump Files The minidump functions provide a way for applications to produce crashdump files that contain a useful subset of the entire process context; this is known as a minidump file. The following functions are used with minidump files. MiniDumpCallback MiniDumpReadDumpStream MiniDumpWriteDump Source Server Source server enables a client to retrieve the exact version of the source files that were used to build an application. The following functions are used with source server. SymGetSourceFile SymGetSourceFileFromToken SymGetSourceFileToken Obsolete Functions MapDebugInformation SymEnumerateSymbols64 SymGetSymFromAddr64 SymGetSymFromName64 SymGetSymNext64 SymGetSymPrev64 UnMapDebugInformation Send comments about this topic to Microsoft Build date: 8/10/2007

[fly_dragon_fly]

dump文件有全部和mini两种吧，保存dump时的堆栈之类的数据。用windbg打开看一下就知道了