Can I use WinDbg to dump structs for other platforms?

Question

I'm using WinDbg to dump struct information, for example:

lkd> dt nt!_LIST_ENTRY +0x000 Flink : Ptr32 _LIST_ENTRY +0x004 Blink : Ptr32 _LIST_ENTRY

The example above shows the 32-bit version of the _LIST_ENTRY struct. The 64-bit version is larger, with Blink at 0x008.

I understand that I can debug remote systems or analyze crash dumps, as long as I load the correct symbols for those Windows versions.

My question: Is it possible to dump structs for different Windows versions than the one I am running, without debugging remotely or analyzing a crash dump?

Answer 1

Yes so long as you have the correct symbols you can dump structs for different windows versions.

The dump will contain the windows version and signature that is expected for the symbols that must match the pdbs.

EDIT

With respect to your specific issue of debugging a 64-bit dump/process on 32-bit OS, it looks like you need to be on a 64-bit OS and use the 64-bit WinDbg.

Answer 2

If you have a 64 bit module ( ntoskrnl.exe for example ) you can load it by "Open Crash Dump..." command and dump information.

Another way: if you have a pdb file for 64 bit module, you can use pdbdump utility