Showing DMP file information in my application

Question

I would also like to be able to show information on the .DMP files located in C:\Windows\MiniDump or c:\windows\memory.dmp - i.e. in same sort of way as
http://www.nirsoft.net/utils/blue_screen_view.html  and
http://www.resplendence.com/whocrashed do it
I have managed to do it for .WER files as per other forum post - but it is not so simple with .DMP files as you cannot simply see lines of information inside them - but it must be possible as the above tool Blue Screen View is only small/simple and somehow
can show you information like in screenshot below - I would like to achieve something similar to that - so basically you can see list of the dmp files with date and at least information such as error (bug check string) and faulting module
Any thoughts/ideas/guidance on how I could do this??
Many thanks
Darren Rose

Answer 1

I have worked out how to achieve my requirements using files from the debugging tools download - still not sure how above programs do it without, but perhaps they have just integrated the files in their apps
My code is below for anyone who is interested - probably not best code in world, but it does what I need
It requires the following files from the standalone debugging tools (https://msdn.microsoft.com/en-US/windows/hardware/gg454513):-
dbgeng.dll
dbghelp.dll
kd.exe
symsrv.dll
triage/triage.ini
winext/ext.dll
winext/kext.dll
Imports System.IO
Public Class Form1
Dim ListViewDMPlog As ListViewItem = Nothing
Dim arrayDMPlog(6) As String
Private Sub Form1_Load(sender As Object, e As EventArgs) Handles MyBase.Load
End Sub
Private Sub btnScanDMPFiles_Click(sender As Object, e As EventArgs) Handles btnScanDMPFiles.Click
' disables scan button
btnScanDMPFiles.Enabled = False
' create listview for showing dmp file details
lvwDMP.View = View.Details
' Clear existing items from listview
lvwDMP.Clear()
' Create columns and set width
lvwDMP.Columns.Add("Crash Time", 120)
lvwDMP.Columns.Add("File Name", 150)
lvwDMP.Columns.Add("Caused By", 100)
lvwDMP.Columns.Add("Error", 220)
lvwDMP.Columns.Add("System Uptime", 100)
lvwDMP.Columns.Add("Full Path", 250)
lvwDMP.FullRowSelect = True
Try
' Code to collect all .dmp files in c:\windows\minidump and add them to a list - courtesy of Frank L Smith :)
Dim DMPFileList As New List(Of String)
Dim dirPath As String = "C:\Windows\MiniDump"
Dim di As New IO.DirectoryInfo(dirPath)
If Directory.Exists(dirPath) Then
Dim qry As IOrderedEnumerable(Of String) = From fi As IO.FileInfo In di.EnumerateFiles("*.dmp") Select fi.FullName Order By FullName
If qry IsNot Nothing AndAlso qry.Count > 0 Then
DMPFileList = qry.ToList
End If
End If
' checks for memory.dmp in c:\windows and if exists then adds it to list
If File.Exists("C:\windows\memory.dmp") Then
DMPFileList.Add("C:\windows\memory.dmp")
End If
For Each Path As String In DMPFileList
' working cmd when run from cmd prompt to analyze dmp files (or can use cdb)
' kd -z C:\Windows\MiniDump\042414-24632-01.dmp -c "!analyze -v;q"
' alternative version which downloads symbols (not used as very slow, not reliable and often gives no more information anyway)
' kd -z C:\Windows\MiniDump\042414-24632-01.dmp -y "srv*Symbols*http://msdl.microsoft.com/download/symbols" -c "!symfix!analyze -v;q"
' N.B. for some reason -v was being interpreted as ûv - so replaced - with Chr(45)
Dim myprocess As New Process()
myprocess.StartInfo.FileName = My.Application.Info.DirectoryPath & "\DMP\kd"
myprocess.StartInfo.Arguments = "-z " & Path & " -c ""!analyze " & Chr(45) & "v;q"""
' below version includes symbol download
' myprocess.StartInfo.Arguments = "-z " & Path & " -y ""srv*Symbols*http://msdl.microsoft.com/download/symbols"" -c ""!symfix!analyze " & Chr(45) & "v;q"""
myprocess.StartInfo.UseShellExecute = False
myprocess.StartInfo.RedirectStandardOutput = True
myprocess.StartInfo.CreateNoWindow = True
myprocess.Start()
Dim output As String = myprocess.StandardOutput.ReadToEnd()
Dim causedby As String = ""
Dim bucketID As String = ""
Dim bugcheckstr As String = ""
Dim uptime As String = ""
' get date of .dmp file
Dim filedate As String = System.IO.File.GetLastWriteTime(Path)
arrayDMPlog(0) = filedate
' gets filename of .dmp file by extracting it from dump file path
Dim filePath As String = Path
Dim slashPosition As Integer = filePath.LastIndexOf("\")
Dim filenameOnly As String = filePath.Substring(slashPosition + 1)
arrayDMPlog(1) = filenameOnly
' get name of file which caused crash
' changed from Probably caused by to IMAGE_NAME as more accurate??!
' causedby = GetStringFromDMPFile(output, "Probably caused by")
causedby = GetStringFromDMPFile(output, "IMAGE_NAME")
arrayDMPlog(2) = causedby.Trim
' get default bucket ID or bugcheck string - if bugcheck contains a 0x value rather than a string then show bucket ID instead
bucketID = GetStringFromDMPFile(output, "DEFAULT_BUCKET_ID")
bugcheckstr = GetStringFromDMPFile(output, "BUGCHECK_STR")
If bugcheckstr.Contains("0x") Then
arrayDMPlog(3) = bucketID.Trim
Else
arrayDMPlog(3) = bugcheckstr.Trim
End If
' get system uptime
uptime = GetStringFromDMPFile(output, "System Uptime")
arrayDMPlog(4) = uptime.Trim & " hours"
' adds full path of dump file
arrayDMPlog(5) = Path
'add items to listview
ListViewDMPlog = New ListViewItem(arrayDMPlog)
lvwDMP.Items.Add(ListViewDMPlog)
Next
' enables scan button
btnScanDMPFiles.Enabled = True
Catch ex As Exception
MsgBox(ex.Message)
End Try
End Sub
' Function to retrieve selected string (information) from chosen log file
Private Function GetStringFromDMPFile(DMPFile As String, Text As String) As String
Dim lines As String() = DMPFile.Split(New String() {vbLf}, StringSplitOptions.RemoveEmptyEntries)
Dim value = ""
For Each line As String In lines
If line.StartsWith(Text) Then
Dim infos As String() = line.Split(":")
value = infos(1)
End If
Next
Return value
End Function
Private Sub lvwDMP_ItemSelectionChanged(sender As Object, e As ListViewItemSelectionChangedEventArgs) Handles lvwDMP.ItemSelectionChanged
tbDMPDetails.Clear()
' N.B. using more switches here so can show more detailed report i.e. ;r;kv;lmnt
If Me.lvwDMP.SelectedItems.Count > 0 Then
Dim myprocess As New Process()
myprocess.StartInfo.FileName = My.Application.Info.DirectoryPath & "\DMP\kd"
myprocess.StartInfo.Arguments = "-z " & Me.lvwDMP.SelectedItems(0).SubItems(5).Text & " -c ""!analyze " & Chr(45) & "v;r;kv;lmnt;q"""
myprocess.StartInfo.UseShellExecute = False
myprocess.StartInfo.RedirectStandardOutput = True
myprocess.StartInfo.CreateNoWindow = True
myprocess.Start()
Dim lines As String() = myprocess.StandardOutput.ReadToEnd().Split(New String() {vbLf}, StringSplitOptions.RemoveEmptyEntries)
Dim value = ""
For Each line As String In lines
tbDMPDetails.AppendText(line & vbCrLf)
Next
End If
' scrolls back to top of text box
tbDMPDetails.SelectionStart = 0
tbDMPDetails.ScrollToCaret()
End Sub
End Class
Darren Rose