Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I used Task Manager (Windows 7, 64-bit) to dump the memory of Chrome processes.

Unfortunately, attempting to dump a 32-bit process using the (64-bit) Task Manager will generate nonsensical memory dumps.

If I did use Task Manager (64-bit) to generate a dump of a 32-bit process, is there a way to convert the already-done memory dump so that it will be properly analyzed?

Also, if you have full memory dump available, can a person re-create processes and programs running before crash occurred?

Edit: It seems that many people are confused of my intention:

I already created memory dumps of 32-bit Chrome processes using Windows Task Manager (64-bit). Then I came to read articles that say this will create a corrupted version of memory dump.

What I am wondering is, can the dump ever be read properly with these dumps?

And also the second question.

What do I mean corrupted?

From one of the supplied links:

If you capture a dump with a tool that captures 64-bit dumps you will still get a memory dump, but you will get a memory dump of the syswow64 which means that a lot of extensions like sos and psscor2 won’t be able to read the data. Some things may still work but it is very limited and you might get errors or erroneous call stacks etc.

See also

share|improve this question
    
Have you determined the dump was even messed up? Provide us the link to the article it might be incorrect, written by a hack, who has no idea what they are talking about. –  Ramhound Aug 28 '13 at 12:19
    
The link's devopsonwindows.com/memory-dumps-done-right –  MEMDU Aug 28 '13 at 12:25
    
@Membu Figures its blocked. The title of the article seems to indicate it talks about the correct way to do memory dumps, have you followed that guidence, and what was your result? –  Ramhound Aug 28 '13 at 12:28
    
Another link: blogs.msdn.com/b/tess/archive/2010/09/29/… The reason I am asking this question is because I did not know this kind of thing, and just read these articles. So I did not follow the guidance. That's why I am asking this question. –  MEMDU Aug 28 '13 at 12:32
    
The second article mentions tools you can use. Have you used those tools? –  Ramhound Aug 28 '13 at 13:27

2 Answers 2

You need to use Process Explorer 15.3 (or higher version) from sysinternals which is aware of the architecture and creates proper dumps.

Process Explorer v15.3: This major Process Explorer release includes heat-map display for process CPU, private bytes, working set and GPU columns, sortable security groups in the process properties security page, and tooltip reporting of tasks executing in Windows 8 Taskhostex processes. It also creates dump files that match the bitness of the target process and works around a bug introduced in Windows 8 disk counter reporting.

http://blogs.technet.com/b/sysinternals/archive/2013/02/04/updates-pendmoves-v1-2-process-explorer-v15-3-sigcheck-v1-91-zoomit-v4-42.aspx

share|improve this answer

There is no way to convert one kind of memory dump to another.

And for anyone wondering, you should manually run the 32-bit Task Manager:

C:\Windows\SysWOW64\TaskMgr.exe

if you want to generate a dump of a 32-bit process

enter image description here

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.