恢复内存转储 [英] Restore memory dump

问题描述

如果在没有调试器的计算机上进行测试，说客户端的计算机，我遇到可能已经损坏程序状态但没有实际崩溃的错误，我知道我可以使用Windows任务管理器进行内存转储（右键单击进程名称，创建转储文件）。

If in testing on a computer without a debugger, say a client's computer, I encounter a bug that may have corrupted the state of the program but not actually crashed it, I know I can take a memory dump using the Windows Task Manager (right click on process name, create dump file).

我可以使用这些与WinDbg在内存中等待，但对我来说最有用的是能够将转储恢复到内存中，以便我可以继续与程序进行交互。这可能吗？如果是这样，怎么办？有没有可以恢复它的工具，或者我需要自己编写。

I can use these with WinDbg to peek around in memory, etc., but what would be most useful to me is to be able to restore the dump into memory so that I can continue interacting with the program. Is this possible? If so, how? Is there a tool that can restore it or do I need to write my own.

推荐答案

典型的usermode转储或minidumps不包含足够的信息来做到这一点。虽然它们包含所有的usermode内存，但它们不包含内核内存，因此内核资源（如文件或网络套接字）的打开句柄不会包含在转储中（即使是这样，硬盘最有可能更改，因此只是尝试写入硬盘可能会损坏系统更多）。

The typical usermode dumps or minidumps do not contain enough information to do so. While they contain all usermode memory, they do not contain kernel memory, so open handles to kernel resources like files or network sockets will not be included in the dump (and even if they were, the hard disk has most likely changed so just trying to write to the hard disk may corrupt your system even more).

我看到恢复内存转储的唯一方法是恢复完整内存和所有其他状态，如硬盘状态，这可以通过大多数虚拟机软件来完成（然而，这将在恢复时断开所有的网络连接;感谢大多数程序可以比丢失的文件句柄处理丢失的网络连接）。

The only way I see to restore a memory dump is restoring the full memory and all other state like hard disk state, which can be done with most virtual machine software (which will, however, disconnect all your network connections on restore; gratefully most programs can handle lost network connectsions better than lost file handles).

这篇关于恢复内存转储的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！