MiniDumpWriteDump another process
I'm trying to create a service with the goal of monitor the applications created by my company.
When the app gets the state of No responding, the service have to generate a a dump with MiniDumpWriteDump
.
The problem is: when using HANDLE
of another process, the MiniDumpWriteDump
doesn't work. The .dmp file stays empty.
GetLastError
returns 0xD0000008 (3489660936)
That function is to get HANDLE
by pid:
void CDumpGenerator::FindAndSetHandle()
{
HANDLE hProcessSnap;
HANDLE hProcess;
PROCESSENTRY32 pe32;
EnableDebugPriv();
hProcessSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
if (hProcessSnap == INVALID_HANDLE_VALUE)
return;
pe32.dwSize = sizeof(PROCESSENTRY32);
if (!Process32First(hProcessSnap, &pe32))
{
CloseHandle(hProcessSnap);
return;
}
do
{
hProcess = OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_READ | PROCESS_DUP_HANDLE, FALSE, pe32.th32ProcessID);
if (hProcess != NULL)
CloseHandle(hProcess);
if (pe32.th32ProcessID == this->pid)
{
this->processHandle = hProcess;
break;
}
} while (Process32Next(hProcessSnap, &pe32));
CloseHandle(hProcessSnap);
}
EnableDebugPriv:
void EnableDebugPriv()
{
HANDLE hToken;
LUID luid;
TOKEN_PRIVILEGES tkp;
OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &hToken);
LookupPrivilegeValue(NULL, SE_DEBUG_NAME, &luid);
tkp.PrivilegeCount = 1;
tkp.Privileges[0].Luid = luid;
tkp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
AdjustTokenPrivileges(hToken, false, &tkp, sizeof(tkp), NULL, NULL);
CloseHandle(hToken);
}
And i'm calling MiniDumpWriteDump
this way:
auto dumped = MiniDumpWriteDump(
this->processHandle,
this->pid,
hFile,
MINIDUMP_TYPE(MiniDumpNormal | MiniDumpWithThreadInfo | MiniDumpWithProcessThreadData | MiniDumpWithFullMemoryInfo),
nullptr,
&userStream,
nullptr);
When I change this->processHandle
to GetCurrentProcess()
works fine.
Handle being set:
Here is the GetLastError()
c dump minidumpwritedump
|
show 1 more comment
I'm trying to create a service with the goal of monitor the applications created by my company.
When the app gets the state of No responding, the service have to generate a a dump with MiniDumpWriteDump
.
The problem is: when using HANDLE
of another process, the MiniDumpWriteDump
doesn't work. The .dmp file stays empty.
GetLastError
returns 0xD0000008 (3489660936)
That function is to get HANDLE
by pid:
void CDumpGenerator::FindAndSetHandle()
{
HANDLE hProcessSnap;
HANDLE hProcess;
PROCESSENTRY32 pe32;
EnableDebugPriv();
hProcessSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
if (hProcessSnap == INVALID_HANDLE_VALUE)
return;
pe32.dwSize = sizeof(PROCESSENTRY32);
if (!Process32First(hProcessSnap, &pe32))
{
CloseHandle(hProcessSnap);
return;
}
do
{
hProcess = OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_READ | PROCESS_DUP_HANDLE, FALSE, pe32.th32ProcessID);
if (hProcess != NULL)
CloseHandle(hProcess);
if (pe32.th32ProcessID == this->pid)
{
this->processHandle = hProcess;
break;
}
} while (Process32Next(hProcessSnap, &pe32));
CloseHandle(hProcessSnap);
}
EnableDebugPriv:
void EnableDebugPriv()
{
HANDLE hToken;
LUID luid;
TOKEN_PRIVILEGES tkp;
OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &hToken);
LookupPrivilegeValue(NULL, SE_DEBUG_NAME, &luid);
tkp.PrivilegeCount = 1;
tkp.Privileges[0].Luid = luid;
tkp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
AdjustTokenPrivileges(hToken, false, &tkp, sizeof(tkp), NULL, NULL);
CloseHandle(hToken);
}
And i'm calling MiniDumpWriteDump
this way:
auto dumped = MiniDumpWriteDump(
this->processHandle,
this->pid,
hFile,
MINIDUMP_TYPE(MiniDumpNormal | MiniDumpWithThreadInfo | MiniDumpWithProcessThreadData | MiniDumpWithFullMemoryInfo),
nullptr,
&userStream,
nullptr);
When I change this->processHandle
to GetCurrentProcess()
works fine.
Handle being set:
Here is the GetLastError()
c dump minidumpwritedump
1
Improve the error reporting so we don't have to guess why "it didn't work". Call GetLastError() when it returns FALSE. Also run SysInternals' ProcDump utility to see if it has any better luck, that localizes the problem.
– Hans Passant
Nov 23 '18 at 12:51
@HansPassant TheGetLastError
returns me 0xD0000008. I didn't knew about ProcDump. I will see.
– Kevin Kouketsu
Nov 23 '18 at 12:56
That's obscure, but looks a lot like an "invalid handle" error. It is notable that FindAndSetHandle() can't tell you that it failed to find the process, that's not good. Could be the hFile as well.
– Hans Passant
Nov 23 '18 at 13:18
@HansPassant I change toGetCurrentProcess
works and all dump is wrote so I think it's notCreateFileA
. When I was debugging line by line onFindAndSetHandle
I see the processHandle being setted.
– Kevin Kouketsu
Nov 23 '18 at 13:22
Another bug in FindAndSetHandle() is that it generates a bad handle value when OpenProcess() failed. Do take care of the basics, cuts down on the guessing.
– Hans Passant
Nov 23 '18 at 13:44
|
show 1 more comment
I'm trying to create a service with the goal of monitor the applications created by my company.
When the app gets the state of No responding, the service have to generate a a dump with MiniDumpWriteDump
.
The problem is: when using HANDLE
of another process, the MiniDumpWriteDump
doesn't work. The .dmp file stays empty.
GetLastError
returns 0xD0000008 (3489660936)
That function is to get HANDLE
by pid:
void CDumpGenerator::FindAndSetHandle()
{
HANDLE hProcessSnap;
HANDLE hProcess;
PROCESSENTRY32 pe32;
EnableDebugPriv();
hProcessSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
if (hProcessSnap == INVALID_HANDLE_VALUE)
return;
pe32.dwSize = sizeof(PROCESSENTRY32);
if (!Process32First(hProcessSnap, &pe32))
{
CloseHandle(hProcessSnap);
return;
}
do
{
hProcess = OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_READ | PROCESS_DUP_HANDLE, FALSE, pe32.th32ProcessID);
if (hProcess != NULL)
CloseHandle(hProcess);
if (pe32.th32ProcessID == this->pid)
{
this->processHandle = hProcess;
break;
}
} while (Process32Next(hProcessSnap, &pe32));
CloseHandle(hProcessSnap);
}
EnableDebugPriv:
void EnableDebugPriv()
{
HANDLE hToken;
LUID luid;
TOKEN_PRIVILEGES tkp;
OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &hToken);
LookupPrivilegeValue(NULL, SE_DEBUG_NAME, &luid);
tkp.PrivilegeCount = 1;
tkp.Privileges[0].Luid = luid;
tkp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
AdjustTokenPrivileges(hToken, false, &tkp, sizeof(tkp), NULL, NULL);
CloseHandle(hToken);
}
And i'm calling MiniDumpWriteDump
this way:
auto dumped = MiniDumpWriteDump(
this->processHandle,
this->pid,
hFile,
MINIDUMP_TYPE(MiniDumpNormal | MiniDumpWithThreadInfo | MiniDumpWithProcessThreadData | MiniDumpWithFullMemoryInfo),
nullptr,
&userStream,
nullptr);
When I change this->processHandle
to GetCurrentProcess()
works fine.
Handle being set:
Here is the GetLastError()
c dump minidumpwritedump
I'm trying to create a service with the goal of monitor the applications created by my company.
When the app gets the state of No responding, the service have to generate a a dump with MiniDumpWriteDump
.
The problem is: when using HANDLE
of another process, the MiniDumpWriteDump
doesn't work. The .dmp file stays empty.
GetLastError
returns 0xD0000008 (3489660936)
That function is to get HANDLE
by pid:
void CDumpGenerator::FindAndSetHandle()
{
HANDLE hProcessSnap;
HANDLE hProcess;
PROCESSENTRY32 pe32;
EnableDebugPriv();
hProcessSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
if (hProcessSnap == INVALID_HANDLE_VALUE)
return;
pe32.dwSize = sizeof(PROCESSENTRY32);
if (!Process32First(hProcessSnap, &pe32))
{
CloseHandle(hProcessSnap);
return;
}
do
{
hProcess = OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_READ | PROCESS_DUP_HANDLE, FALSE, pe32.th32ProcessID);
if (hProcess != NULL)
CloseHandle(hProcess);
if (pe32.th32ProcessID == this->pid)
{
this->processHandle = hProcess;
break;
}
} while (Process32Next(hProcessSnap, &pe32));
CloseHandle(hProcessSnap);
}
EnableDebugPriv:
void EnableDebugPriv()
{
HANDLE hToken;
LUID luid;
TOKEN_PRIVILEGES tkp;
OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &hToken);
LookupPrivilegeValue(NULL, SE_DEBUG_NAME, &luid);
tkp.PrivilegeCount = 1;
tkp.Privileges[0].Luid = luid;
tkp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
AdjustTokenPrivileges(hToken, false, &tkp, sizeof(tkp), NULL, NULL);
CloseHandle(hToken);
}
And i'm calling MiniDumpWriteDump
this way:
auto dumped = MiniDumpWriteDump(
this->processHandle,
this->pid,
hFile,
MINIDUMP_TYPE(MiniDumpNormal | MiniDumpWithThreadInfo | MiniDumpWithProcessThreadData | MiniDumpWithFullMemoryInfo),
nullptr,
&userStream,
nullptr);
When I change this->processHandle
to GetCurrentProcess()
works fine.
Handle being set:
Here is the GetLastError()
c dump minidumpwritedump
c dump minidumpwritedump
edited Nov 23 '18 at 13:26
Kevin Kouketsu
asked Nov 23 '18 at 12:45
Kevin KouketsuKevin Kouketsu
362213
362213
1
Improve the error reporting so we don't have to guess why "it didn't work". Call GetLastError() when it returns FALSE. Also run SysInternals' ProcDump utility to see if it has any better luck, that localizes the problem.
– Hans Passant
Nov 23 '18 at 12:51
@HansPassant TheGetLastError
returns me 0xD0000008. I didn't knew about ProcDump. I will see.
– Kevin Kouketsu
Nov 23 '18 at 12:56
That's obscure, but looks a lot like an "invalid handle" error. It is notable that FindAndSetHandle() can't tell you that it failed to find the process, that's not good. Could be the hFile as well.
– Hans Passant
Nov 23 '18 at 13:18
@HansPassant I change toGetCurrentProcess
works and all dump is wrote so I think it's notCreateFileA
. When I was debugging line by line onFindAndSetHandle
I see the processHandle being setted.
– Kevin Kouketsu
Nov 23 '18 at 13:22
Another bug in FindAndSetHandle() is that it generates a bad handle value when OpenProcess() failed. Do take care of the basics, cuts down on the guessing.
– Hans Passant
Nov 23 '18 at 13:44
|
show 1 more comment
1
Improve the error reporting so we don't have to guess why "it didn't work". Call GetLastError() when it returns FALSE. Also run SysInternals' ProcDump utility to see if it has any better luck, that localizes the problem.
– Hans Passant
Nov 23 '18 at 12:51
@HansPassant TheGetLastError
returns me 0xD0000008. I didn't knew about ProcDump. I will see.
– Kevin Kouketsu
Nov 23 '18 at 12:56
That's obscure, but looks a lot like an "invalid handle" error. It is notable that FindAndSetHandle() can't tell you that it failed to find the process, that's not good. Could be the hFile as well.
– Hans Passant
Nov 23 '18 at 13:18
@HansPassant I change toGetCurrentProcess
works and all dump is wrote so I think it's notCreateFileA
. When I was debugging line by line onFindAndSetHandle
I see the processHandle being setted.
– Kevin Kouketsu
Nov 23 '18 at 13:22
Another bug in FindAndSetHandle() is that it generates a bad handle value when OpenProcess() failed. Do take care of the basics, cuts down on the guessing.
– Hans Passant
Nov 23 '18 at 13:44
1
1
Improve the error reporting so we don't have to guess why "it didn't work". Call GetLastError() when it returns FALSE. Also run SysInternals' ProcDump utility to see if it has any better luck, that localizes the problem.
– Hans Passant
Nov 23 '18 at 12:51
Improve the error reporting so we don't have to guess why "it didn't work". Call GetLastError() when it returns FALSE. Also run SysInternals' ProcDump utility to see if it has any better luck, that localizes the problem.
– Hans Passant
Nov 23 '18 at 12:51
@HansPassant The
GetLastError
returns me 0xD0000008. I didn't knew about ProcDump. I will see.– Kevin Kouketsu
Nov 23 '18 at 12:56
@HansPassant The
GetLastError
returns me 0xD0000008. I didn't knew about ProcDump. I will see.– Kevin Kouketsu
Nov 23 '18 at 12:56
That's obscure, but looks a lot like an "invalid handle" error. It is notable that FindAndSetHandle() can't tell you that it failed to find the process, that's not good. Could be the hFile as well.
– Hans Passant
Nov 23 '18 at 13:18
That's obscure, but looks a lot like an "invalid handle" error. It is notable that FindAndSetHandle() can't tell you that it failed to find the process, that's not good. Could be the hFile as well.
– Hans Passant
Nov 23 '18 at 13:18
@HansPassant I change to
GetCurrentProcess
works and all dump is wrote so I think it's not CreateFileA
. When I was debugging line by line on FindAndSetHandle
I see the processHandle being setted.– Kevin Kouketsu
Nov 23 '18 at 13:22
@HansPassant I change to
GetCurrentProcess
works and all dump is wrote so I think it's not CreateFileA
. When I was debugging line by line on FindAndSetHandle
I see the processHandle being setted.– Kevin Kouketsu
Nov 23 '18 at 13:22
Another bug in FindAndSetHandle() is that it generates a bad handle value when OpenProcess() failed. Do take care of the basics, cuts down on the guessing.
– Hans Passant
Nov 23 '18 at 13:44
Another bug in FindAndSetHandle() is that it generates a bad handle value when OpenProcess() failed. Do take care of the basics, cuts down on the guessing.
– Hans Passant
Nov 23 '18 at 13:44
|
show 1 more comment
1 Answer
1
active
oldest
votes
I just solved the problem removing this part
hProcess = OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_READ | PROCESS_DUP_HANDLE, FALSE, pe32.th32ProcessID);
// This close handle
if (hProcess != NULL)
CloseHandle(hProcess);
It's a simple thing that went unseen. So we need close handle on other part of code like destructor or anything else.
add a comment |
Your Answer
StackExchange.ifUsing("editor", function () {
StackExchange.using("externalEditor", function () {
StackExchange.using("snippets", function () {
StackExchange.snippets.init();
});
});
}, "code-snippets");
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "1"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53446982%2fminidumpwritedump-another-process%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
I just solved the problem removing this part
hProcess = OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_READ | PROCESS_DUP_HANDLE, FALSE, pe32.th32ProcessID);
// This close handle
if (hProcess != NULL)
CloseHandle(hProcess);
It's a simple thing that went unseen. So we need close handle on other part of code like destructor or anything else.
add a comment |
I just solved the problem removing this part
hProcess = OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_READ | PROCESS_DUP_HANDLE, FALSE, pe32.th32ProcessID);
// This close handle
if (hProcess != NULL)
CloseHandle(hProcess);
It's a simple thing that went unseen. So we need close handle on other part of code like destructor or anything else.
add a comment |
I just solved the problem removing this part
hProcess = OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_READ | PROCESS_DUP_HANDLE, FALSE, pe32.th32ProcessID);
// This close handle
if (hProcess != NULL)
CloseHandle(hProcess);
It's a simple thing that went unseen. So we need close handle on other part of code like destructor or anything else.
I just solved the problem removing this part
hProcess = OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_READ | PROCESS_DUP_HANDLE, FALSE, pe32.th32ProcessID);
// This close handle
if (hProcess != NULL)
CloseHandle(hProcess);
It's a simple thing that went unseen. So we need close handle on other part of code like destructor or anything else.
answered Nov 27 '18 at 11:35
Kevin KouketsuKevin Kouketsu
362213
362213
add a comment |
add a comment |
Thanks for contributing an answer to Stack Overflow!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53446982%2fminidumpwritedump-another-process%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
1
Improve the error reporting so we don't have to guess why "it didn't work". Call GetLastError() when it returns FALSE. Also run SysInternals' ProcDump utility to see if it has any better luck, that localizes the problem.
– Hans Passant
Nov 23 '18 at 12:51
@HansPassant The
GetLastError
returns me 0xD0000008. I didn't knew about ProcDump. I will see.– Kevin Kouketsu
Nov 23 '18 at 12:56
That's obscure, but looks a lot like an "invalid handle" error. It is notable that FindAndSetHandle() can't tell you that it failed to find the process, that's not good. Could be the hFile as well.
– Hans Passant
Nov 23 '18 at 13:18
@HansPassant I change to
GetCurrentProcess
works and all dump is wrote so I think it's notCreateFileA
. When I was debugging line by line onFindAndSetHandle
I see the processHandle being setted.– Kevin Kouketsu
Nov 23 '18 at 13:22
Another bug in FindAndSetHandle() is that it generates a bad handle value when OpenProcess() failed. Do take care of the basics, cuts down on the guessing.
– Hans Passant
Nov 23 '18 at 13:44