Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Idea: Search&DumpData to Disk #12

Open
cw2k opened this issue Oct 31, 2020 · 2 comments
Open

Idea: Search&DumpData to Disk #12

cw2k opened this issue Oct 31, 2020 · 2 comments

Comments

@cw2k
Copy link

cw2k commented Oct 31, 2020

I just tested MinidumpExplorer.
Hmm to me it would add much value to be able to to search & dump certain memory regions from memory Info.
Just image your favorite program just crashed and you want to recover certain data from the *.dmp file.

So just make the MemoryInfo tab able to do a multiselection on that listView.
Enrich that context menu View with Search and Dump add the handler function that will do what this context menu shows...
... and make me and for sure some other people happy.

Add the filename column from [Module] as well in Memory info. Use Base address as key to join them.
Add an option to enable/disable this since its not the actual data as stored in the *.dmp.

@GregTheDev
Copy link
Owner

Awesome, thanks the ideas, sounds great. I’ll get on it and see what I can do.

@GregTheDev
Copy link
Owner

I've been giving your ideas quite a bit of thought, and I think I may have been partly wrong in adding the "View" option to the MemoryInfo tab originally.

My reason for thinking this is that the MemoryInfo stream:

"... corresponds to what VirtualQuery would return for the process the dump was created for"

i.e. it's what's the virtual address space of the process looked like while it was running. Depending on what options were used when the dump was created either a lot, or almost none of those regions will actually be included as part of the dump. You could end up selecting "View" over and over and keep getting told that the region couldn't be found inside the dump. This could be very frustrating to the user since there's no easy way to know whether the region is available or not. However, the view does provide very useful information, as can be seen from your ideas :)

Given that, the first thing I'm going to do is add an indicator so that users can tell up front which regions are actually available.

What do you think of this?

MemoryInfoPreview

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants