How to use Windbg.exe to collect a memory dump

[#1]

Environment

• Microsoft Windows: All Supported Versions

Objective

This article provides step by step instructions on how to collect a memory dump when application crashes for all other reasons besides an access violation. 

Resolution

1. Download Windbg at Download Debugging Tools for Windows - WinDbg - Windows drivers
2. Install windbg to the default location. (Ex: C:\Program Files (x86)\Windows Kits\10\). When selecting features during install only "Debugging Tools for Windows" is required
3. Launch gflags.exe (Ex: C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\gflags.exe)
4. Select the Image File (tab)
5. Enter the application name under the Image field (Ex: winword.exe)
6. Select the debugger check box and enter the full pack of windbg (ex: C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\windbg.exe) 
   
7. This should allow Windbg to attach to the specific process, launch windbg automatically when the application crashes, capture the exception, then break. At this point enter the following command to create the dump file
8. .dump /ma <folder location of the dump file> (ex: .dump /ma C:/dumpfile) 
   

 

Additional Notes

• Typically memory dumps for application crashes can be collected using Windows procdump, but procdump only collects a dump automatically when the application crashes due to an access violation.

Related Content

Download Debugging Tools for Windows - WinDbg - Windows drivers