!$! Getting Core Dump from running process!$!

Follow these steps in order to get a core dump from a running process. In this example, I am getting a core dump for MS Outlook process.

* First, you need to download and install the Debugging tools for Windows. Click here to get it.

* Once the Debugging tools re installed, launch WinDbg > Click on File > Attach to a process or you can just hit F6.
* Select outlook.exe process from the list THEN click OK.

* After you click OK, you should see the following screen:

* At the bottom of the screen, there should be a place where you can type commands, Go ahead and type in this command:

.dump /ma c:\cores\outlook.dmp

NOTE:

The /ma switch will add full memory data, handle data, unloaded module information, basic memory information, and thread time information to the minidump.

The "C:\cores " is where I store the dump.

Outlook.dmp is the name I gave to the core dump.

* After the core dump has been created, You should see a screen like the follwoing that says "Dump Successfully Written".

And that's it ... You're DONE. Now, you can dive into the core and HAVE FUN.

Thank you