.NET Framework CLR Tools: How do I use the CLR Minidump tool?

[HanneSThEGreaT]

Q: How do I use the CLR Minidump tool?

A: The Common Language Runtime Minidump tool creates a file containing information that is useful for analyzing system problems in the runtime.

• What are Minidump files?
  
  Applications can produce user-mode minidump files, which contain a useful subset of the information contained in a crash dump file. Applications can create minidump files very quickly and efficiently. Because minidump files are small, they can be easily sent over the internet to technical support for the application.
  
  A minidump file does not contain as much information as a full crash dump file, but it contains enough information to perform basic debugging operations. To read a minidump file, you must have the binaries and symbol files available for the debugger.
  
  
  
  
• What 'DbgHelp' functions are used with minidump files?
  
  
  

  'MiniDumpCallback()'
  'MiniDumpReadDumpStream()'
  'MiniDumpWriteDump()'

  
  
• What types of crash dump files are there?
  
  You can set the type of dump file generated, balancing the need for more information with the space available for storing it. Larger dumps provide more information, but embedded devices often have restricted amounts of memory available.
  
  Typically, the error reporting system generates a system dump. However, if the size of the dump file generated would be larger than the space allocated to it, the system generates a much smaller context dump.
  
  OEMs set registry values that control the type of crash dump to be generated and the amount of memory to reserve for that purpose. Each type of dump follows the same file format.
  
  Error reporting can generate three distinct types of crash dumps:
  
  
  • Context dumps
  • System dumps
  • Complete dumps
  
  
  
  
• What is the difference between the types of crash dumps?
  
  
  • Context Dump
    
    
    • Information about the crashing system
    • Exception that initiated the crash
    • Context record of the faulting thread
    • Module list, limited to the faulting threads of the owner process
    • Thread list, limited to the faulting threads of the owner process
    • Callstack of the faulting thread
    • 64 bytes of memory above and below the instruction pointer of the faulting thread
    • Stack memory dump of the faulting thread, truncated to fit a 64 KB limit
    
    
    
  • System Dump
    
    
    • All information in a Context dump
    • Callstacks and context records for all threads
    • Complete module, process, and thread lists for the entire device
    • 2048 bytes of memory above and below the instruction pointer of the faulting thread.
    • Global variables for the process that was current at the time of the crash
    
    
    
  • Complete dump
    
    
    • All information in a context dump
    • A complete dump of all used memory
  
  
  
  
• How do I use the Minidump tool?
  
  You run the 'mscordmp.exe' tool from the command prompt
  
  
  

  mscordmp [options] /pid processID /out outputFile

  
  
• Can I have an example?
  
  The following command creates a minidump file for the process with the identification number 12345 and saves the output in the file 'myDump'.
  
  
  

  mscordmp /pid 12345 /out myDump