Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I am investigating a BSOD and I'd like to know more about the process that caused the problem. I can open the minidump in WinDbg which gives a lot of information about the crash. However the one piece of information I haven't been able to get is the command line arguments of the process that caused the crash.

Does anyone know if it is something that can be extracted from a crash dump?

Thanks in advance.

share|improve this question
    
Try BlueScreenView and see if it displays what you want. –  Karan Oct 12 '12 at 22:51
    
BlueScreenView didn't help but I found the solution - see answer below. –  Clem Oct 30 '12 at 14:43
add comment

1 Answer 1

up vote 1 down vote accepted

The information I was looking for is stored in the process environment block (PEB). In WinDbg the !peb command displays a formatted view of the PEB. This view contains an entry for the command line that was used to start the process.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.