/* * $Id$ * Copyright 2008-2010 The Eraser Project * Original Author: Joel Low * Modified By: * * This file is part of Eraser. * * Eraser is free software: you can redistribute it and/or modify it under the * terms of the GNU General Public License as published by the Free Software * Foundation, either version 3 of the License, or (at your option) any later * version. * * Eraser is distributed in the hope that it will be useful, but WITHOUT ANY * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR * A PARTICULAR PURPOSE. See the GNU General Public License for more details. * * A copy of the GNU General Public License can be found at * . */ using System; using System.Collections.Generic; using System.Text; using System.Runtime.InteropServices; using Microsoft.Win32.SafeHandles; namespace Eraser.Util { /// /// Stores DLL references for this class. /// private static partial class NativeMethods { /// /// Writes user-mode minidump information to the specified file. /// /// A handle to the process for which the information /// is to be generated. /// The identifier of the process for which the information /// is to be generated. /// A handle to the file in which the information is to be /// written. /// The type of information to be generated. This parameter /// can be one or more of the values from the MINIDUMP_TYPE enumeration. /// A pointer to a MiniDumpExceptionInfo structure /// describing the client exception that caused the minidump to be generated. /// If the value of this parameter is NULL, no exception information is included /// in the minidump file. /// Not supported. Use IntPtr.Zero /// Not supported. Use IntPtr.Zero /// If the function succeeds, the return value is true; otherwise, the /// return value is false. To retrieve extended error information, call GetLastError. /// Note that the last error will be an HRESULT value. [DllImport("dbghelp.dll", SetLastError = true)] [return: MarshalAs(UnmanagedType.Bool)] public static extern bool MiniDumpWriteDump(IntPtr hProcess, uint ProcessId, SafeFileHandle hFile, MiniDumpType DumpType, ref MiniDumpExceptionInfo ExceptionParam, IntPtr UserStreamParam, IntPtr CallbackParam); /// /// Identifies the type of information that will be written to the minidump file /// by the MiniDumpWriteDump function. /// public enum MiniDumpType { /// /// Include just the information necessary to capture stack traces for all /// existing threads in a process. /// MiniDumpNormal = 0x00000000, /// /// Include the data sections from all loaded modules. This results in the /// inclusion of global variables, which can make the minidump file significantly /// larger. For per-module control, use the ModuleWriteDataSeg enumeration /// value from MODULE_WRITE_FLAGS. /// MiniDumpWithDataSegs = 0x00000001, /// /// Include all accessible memory in the process. The raw memory data is /// included at the end, so that the initial structures can be mapped directly /// without the raw memory information. This option can result in a very large /// file. /// MiniDumpWithFullMemory = 0x00000002, /// /// Include high-level information about the operating system handles that are /// active when the minidump is made. /// MiniDumpWithHandleData = 0x00000004, /// /// Stack and backing store memory written to the minidump file should be /// filtered to remove all but the pointer values necessary to reconstruct a /// stack trace. Typically, this removes any private information. /// MiniDumpFilterMemory = 0x00000008, /// /// Stack and backing store memory should be scanned for pointer references /// to modules in the module list. If a module is referenced by stack or backing /// store memory, the ModuleWriteFlags member of the MINIDUMP_CALLBACK_OUTPUT /// structure is set to ModuleReferencedByMemory. /// MiniDumpScanMemory = 0x00000010, /// /// Include information from the list of modules that were recently unloaded, /// if this information is maintained by the operating system. /// MiniDumpWithUnloadedModules = 0x00000020, /// /// Include pages with data referenced by locals or other stack memory. /// This option can increase the size of the minidump file significantly. /// MiniDumpWithIndirectlyReferencedMemory = 0x00000040, /// /// Filter module paths for information such as user names or important /// directories. This option may prevent the system from locating the image /// file and should be used only in special situations. /// MiniDumpFilterModulePaths = 0x00000080, /// /// Include complete per-process and per-thread information from the operating /// system. /// MiniDumpWithProcessThreadData = 0x00000100, /// /// Scan the virtual address space for PAGE_READWRITE memory to be included. /// MiniDumpWithPrivateReadWriteMemory = 0x00000200, /// /// Reduce the data that is dumped by eliminating memory regions that are not /// essential to meet criteria specified for the dump. This can avoid dumping /// memory that may contain data that is private to the user. However, it is /// not a guarantee that no private information will be present. /// MiniDumpWithoutOptionalData = 0x00000400, /// /// Include memory region information. For more information, see /// MINIDUMP_MEMORY_INFO_LIST. /// MiniDumpWithFullMemoryInfo = 0x00000800, /// /// Include thread state information. For more information, see /// MINIDUMP_THREAD_INFO_LIST. /// MiniDumpWithThreadInfo = 0x00001000, /// /// Include all code and code-related sections from loaded modules to capture /// executable content. For per-module control, use the ModuleWriteCodeSegs /// enumeration value from MODULE_WRITE_FLAGS. /// MiniDumpWithCodeSegs = 0x00002000, /// /// Turns off secondary auxiliary-supported memory gathering. /// MiniDumpWithoutAuxiliaryState = 0x00004000, /// /// Requests that auxiliary data providers include their state in the dump /// image; the state data that is included is provider dependent. This option /// can result in a large dump image. /// MiniDumpWithFullAuxiliaryState = 0x00008000, /// /// Scans the virtual address space for PAGE_WRITECOPY memory to be included. /// MiniDumpWithPrivateWriteCopyMemory = 0x00010000, /// /// If you specify MiniDumpWithFullMemory, the MiniDumpWriteDump function will /// fail if the function cannot read the memory regions; however, if you include /// MiniDumpIgnoreInaccessibleMemory, the MiniDumpWriteDump function will /// ignore the memory read failures and continue to generate the dump. Note that /// the inaccessible memory regions are not included in the dump. /// MiniDumpIgnoreInaccessibleMemory = 0x00020000, /// /// Adds security token related data. This will make the "!token" extension work /// when processing a user-mode dump. /// MiniDumpWithTokenInformation = 0x00040000 } /// /// Contains the exception information written to the minidump file by the /// MiniDumpWriteDump function. /// [StructLayout(LayoutKind.Sequential, Pack = 4)] public struct MiniDumpExceptionInfo { /// /// The identifier of the thread throwing the exception. /// public uint ThreadId; /// /// A pointer to an EXCEPTION_POINTERS structure specifying a /// computer-independent description of the exception and the processor /// context at the time of the exception. /// public IntPtr ExceptionPointers; /// /// Determines where to get the memory regions pointed to by the /// ExceptionPointers member. Set to TRUE if the memory resides in the /// process being debugged (the target process of the debugger). Otherwise, /// set to FALSE if the memory resides in the address space of the calling /// program (the debugger process). If you are accessing local memory (in /// the calling process) you should not set this member to TRUE. /// [MarshalAs(UnmanagedType.Bool)] public bool ClientPointers; } } }