none
Windbg - crashdump bitness RRS feed

  • Question

  • Hi,

    Is there a way to find out if a crashdump was created  using 32bit or 64bit debugger?

     

    Thanks,

    Nachiket

    Wednesday, August 31, 2011 6:05 PM

All replies

  • Do you mean the bitness of dump?
    I think, first one can look at header from which system:
    ....
    Loading Dump File [C:\WinDDK\7600.16385.1\Debuggers\ABB.dmp]
    ...
    Executable search path is:
    Windows 7 Kernel Version 7600 MP (2 procs) Free x86 compatible
    Product: WinNt, suite: TerminalServer SingleUserTS Personal
    ...
    Then, I assume, one can use .effmach command (shows where current session machine-type defaulted to)

    0:000> .effmach
    Effective machine: x86 compatible (x86)

    I can try setting to 64bit (or the other way round):

    0:006> .effmach amd64
    Effective machine: x64 (AMD64)
    :006:AMD64> k
    Machine is not a possible execution machine
    Unable to get current machine context, HRESULT 0x8000FFFF
    Unable to get initial context information

    -> really pure 32bit

    For I am only working with 32bit, I do not know, how a pure x64 dump behaves, when setting to x86.
    An error message like above? Or does following k cmd give garbage? 

    Therefore no warranty

    With kind regards

     



    Thursday, September 1, 2011 10:20 AM