3

I'm wanting to use MiniDumpWriteDump to generate crash logs for an application of mine. Microsoft recommends performing the dump from another process, which is what I'm trying to do. The issue I'm having is with passing the PEXCEPTION_INFORMATION structure from the parent to the child process. The issue is that the parent process owns the memory for this structure, and I need to give it to the child. I found this post

How do I get at the exception information when using MiniDumpWriteDump out-of-process?

And the accepted answer said "It doesn't matter that the pointer is not valid in the context of the watchdog process." which lead me to believe I could simply pass the PEXCEPTION_INFORMATION pointer that my unhandled exception filter receives to the child process, and windows would read it from the parent. This isn't happening and so I don't really know what to do, at the moment the child process crashes, presumably because windows tries to access this memory as-if it belonged to the child. I'm obviously missing something here, but I'm not sure what. I use pipes to send data to the child process, and the answer to the above question says using memory mapped files works, but I'm not really sure why, or if I'm understanding the answer correctly.

Community
  • 1
  • 1
user1520427
  • 1,345
  • 1
  • 15
  • 27
  • So what happened when you tried a memory mapped file instead? – Hans Passant Dec 18 '12 at 14:39
  • @HansPassant I haven't tried it because I'm not really sure what file to memory map , or what it would really do. – user1520427 Dec 18 '12 at 14:41
  • @user : Any update on this . i am trying to do it using File Mapping but similar problem of passing exception informations . i landed here http://stackoverflow.com/questions/624691/passing-a-pointer-to-process-spawned-with-exec which says "If you use shared memory, you can't pass the pointer. The pointer will contain the virtual address, which is different from one process to another. You have to exchange offset values, based on the start of the shared memory area." I am stuck in the middle . – Anantha Subramaniam Apr 22 '13 at 12:43
  • @ananth I didn't look into it too much, and I didn't find a way around it. The only way I could think of would be doing a deep copy of the structure, but surely there must be an easier way. – user1520427 Apr 23 '13 at 13:28

1 Answers1

0

Debug the process you want to dump.

typedef struct _EXCEPTION_POINTERS {
    PEXCEPTION_RECORD ExceptionRecord;
    PCONTEXT ContextRecord;
} EXCEPTION_POINTERS, *PEXCEPTION_POINTERS;

ExceptionRecord can be got from EXCEPTION_DEBUG_EVENT by WaitforDebugEventEx.

ContextRecord can be got by OpenThread and GetThreadContext with threadid from DebugEvent

Kbdman
  • 134
  • 1
  • 10