Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I used 64-bit Windows 7's normal task manager (taskmgr) to dump the memory of chrome processes, which are 32-bit, but then I read an article that says it will mess up the dump. If 64-bit taskmgr does mess up the memory dump of 32-bit processes, is there a way to convert the already-done memory dump so that it will be properly analyzed?

Also, if you have full memory dump available, can a person re-create processes and programs running before crash occurred?

http://www.devopsonwindows.com/memory-dumps-done-right/ http://blogs.msdn.com/b/tess/archive/2010/09/29/capturing-memory-dumps-for-32-bit-processes-on-an-x64-machine.aspx

Edit: OK it seems that many people are confused of my intention:

so I already created memory dumps of 32-bit chrome processes using 64-bit Windows task manager. And the processes were shut down. But then I came to read articles that say this will create a corrupted version of memory dump.

So what I am wondering is, can the dump ever be read properly with these dumps?

And comes the second question.

share|improve this question
    
Have you determined the dump was even messed up? Provide us the link to the article it might be incorrect, written by a hack, who has no idea what they are talking about. –  Ramhound Aug 28 '13 at 12:19
    
The link's devopsonwindows.com/memory-dumps-done-right –  MEMDU Aug 28 '13 at 12:25
    
@Membu Figures its blocked. The title of the article seems to indicate it talks about the correct way to do memory dumps, have you followed that guidence, and what was your result? –  Ramhound Aug 28 '13 at 12:28
    
Another link: blogs.msdn.com/b/tess/archive/2010/09/29/… The reason I am asking this question is because I did not know this kind of thing, and just read these articles. So I did not follow the guidance. That's why I am asking this question. –  MEMDU Aug 28 '13 at 12:32
    
The second article mentions tools you can use. Have you used those tools? –  Ramhound Aug 28 '13 at 13:27

1 Answer 1

You need to use Process Explorer 15.3 (or higher version) from sysinternals which is aware of the architecture and creates proper dumps.

Process Explorer v15.3: This major Process Explorer release includes heat-map display for process CPU, private bytes, working set and GPU columns, sortable security groups in the process properties security page, and tooltip reporting of tasks executing in Windows 8 Taskhostex processes. It also creates dump files that match the bitness of the target process and works around a bug introduced in Windows 8 disk counter reporting.

http://blogs.technet.com/b/sysinternals/archive/2013/02/04/updates-pendmoves-v1-2-process-explorer-v15-3-sigcheck-v1-91-zoomit-v4-42.aspx

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.