Note that there are some explanatory texts on larger screens.

plurals
  1. POHow Best to Alias an Executable Name in a WinDBG Crash Script?
    primarykey
    data
    text
    <h3>Background Information</h3> <p>For saving out crash dumps, I have a script passed to <code>cdb.exe</code> in the <code>Debugger</code> value of the <code>AeDebug</code> registry key:</p> <pre><code>C:\progra~1\debugg~1\cdb.exe -p %ld -e %ld -g -y SRV*c:\mss*http://msdl.microsoft.com/download/symbols -c "$&lt;d:\tgticker\Dumps\RDFD.cdbscript" </code></pre> <p>Here is the first portion of the script:</p> <pre><code>as /c CrashFirstModule .printf "%mu", @@c++((*(ntdll!_LDR_DATA_TABLE_ENTRY**)&amp;@$peb-&gt;Ldr-&gt;InLoadOrderModuleList.Flink)-&gt;BaseDllName.Buffer) .logopen /t d:\tgticker\dumps\${CrashFirstModule}_process.log * (...) </code></pre> <h3>The Problem</h3> <p>With symbols, this works exactly as I would like, I get log files with sensible names like:</p> <ul> <li><code>LHCBDRDT.exe_process_147c_2009-01-06_23-10-05-371.log</code></li> </ul> <p>However, if symbols are not available, I get a log file name like this:</p> <ul> <li><code>${CrashFirstModule}_process_17a8_2009-01-06_23-10-01-124.log</code></li> </ul> <p>This is because the alias command has failed to set the alias. The alias command is one that I harvested from <a href="http://www.dumpanalysis.org/blog/index.php/2008/08/13/generating-file-name-for-dump-command/" rel="nofollow noreferrer" title="DumpAnalysis.org: Generating file name for .dump command">DumpAnalysis.org</a>. This command pulls the name out of the PEB Header for the image, using <code>ntdll.dll</code>. Without symbols for the OS, it doesn't know where to find the function it is calling from ntdll.dll.</p> <h3>The Question</h3> <p>Does anyone know or have a command to get the name of the image as an alias for use in filenames which would still work in these situations?</p>
    singulars
    1. This table or related slice is empty.
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
 

Querying!

 
Guidance

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload