switching to user stack in kernel dumps

Question

Is there a way to switch to user mode of a particular process in a kernel dump while doing postmortem debugging ?

I remember doing this while live debugging using the .process command.

Answer 1

.process also works in kernel dumps. First, you can find your process using

!process 0 0 myprocess.exe

and then switch to that process using

.process <address>

where <address> is the hex number after PROCESS.

Note that you are still kernel debugging and you have only the physical memory of that process available (a.k.a. Working Set). The majority of virtual address space is probably swapped to disk and you cannot analyze that process as you would in user mode (especially for .NET programs, where you need the complete .NET heap).

Answer 2

As a follow up to Thomas's response, you can use .process /p /r . This will set your usermode context and reload usermode symbols. This will make your subsequent thread commands in this new process context be able to show the usermode side of the stack. You can skip process navigation if you know your target thread by using .thread /p /r .

Answer 3

1. Find ProcessID

   !process 0 0 process.exe

2. Using ProcessID to find ThreadID

   !process <ProcessID>

3. Switch to the thread

   .thread /p /r <ThreadID>

Answer 4

I have an article that talks about the issues around this and the best ways to do it in both live and crash dump debugging scenarios:

http://www.osronline.com/article.cfm?id=576

Answer 5

!dml_proc extension provides a convenient way to switch to user mode processes with a menu drawn in DML markup: example.