up vote 2 down vote favorite
share [g+] share [fb]

Are there any tools to dump the running application from memory in Windows 7?

link|improve this question
75% accept rate
feedback

3 Answers

up vote 3 down vote accepted

just "right click" the process in the taskmanager and select "create memory dump"

alt text

link|improve this answer
can i still be able to run that file? – abmv Jun 1 '10 at 10:12
@abmv: "run" as in .. start the dump? or do you ask if the dumping process stops the process? if it is the latter: dumping the memory does not stop the process. – akira Jun 1 '10 at 10:41
well i'm looking for something like PROCDUMP32 – abmv Jun 2 '10 at 16:56
@abmv: well, that is not what you asked for in the first place. a good tool for reverse engineering is "ida pro" (hex-rays.com/idapro). – akira Jun 2 '10 at 19:08
i guess the word dump was misleading thanks for you reply – abmv Jun 3 '10 at 7:02
show 2 more comments
feedback
up vote 1 down vote

Simplest is probably procdump from SysInternals.

The Debugging Tools for Windows gives more advanced options (e.g. automatically dump the process on certain conditions).

link|improve this answer
feedback
up vote 0 down vote

You can use adplus -crash -p <process id> -o <place to put the dump> from command line if the process you want to dump is crashing at some point. see here

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.