CODEWITHSUNDEEP
windbgpykd
Thomas Weller
Thomas Weller

Reputation: 59513

Getting the process ID from a crash dump file with PyKd

I am analyzing a lot of crash dumps with Pykd and I would like to get the process ID (PID) from the crash dump.

In WinDbg, I'd use the command | and use my brain to figure it out. Some time later, I'd come up with a command like

.foreach /pS 3 /ps 999 ( pid {|}) {.echo ${pid}}

which extracts the process ID for me.

Just a little bit smarter and I'd use a pseudo register instead:

.printf "%p", $tpid

How would I use PyKD to get the process ID from a user mode crash dump file (.dmp)?

Of course I can always do a pykd.dbgCommand(), but I'd like to use a more robust built-in way.

I have tried

Upvotes: 0

Views: 2048

Answers (3)

ussrhero
ussrhero

Reputation: 606

try to use pykd.getProcessSystemID

https://githomelab.ru/pykd/pykd/-/wikis/API%20Reference#function-getprocesssystemid

getCurrentProcessId has sense if you are debugging several processes and need to switch they contexts ( like | command )

Upvotes: 0

blabb
blabb

Reputation: 9007

0:000> dx Debugger.Sessions.First().Processes
Debugger.Sessions.First().Processes
    [0x294c]         : wait.exe
0:000> .shell -ci ".echo " type f:\src\wait\pid.py
from pykd import *
print(hex(expr("@$tpid"))).shell: Process exited
0:000> !py f:\src\wait\pid.py
0x294c
0:000> |
.  0    id: 294c        examine name: F:\src\wait\wait.exe
0:000>

Upvotes: 0

Thomas Weller
Thomas Weller

Reputation: 59513

The pseudo reguster idea was not that bad:

pykd.expr("$tpid")

gives the process ID as a number. Format it as hexadecimal if it's needed in the same format as |.

Upvotes: 1

Related Questions