CODEWITHSUNDEEP
windbgcrash-dumpssos
Silverlight Student
Silverlight Student

Reputation: 4118

Determine if process dump was generated on x64 or x86 machine

If I have a process dump file, is there anyway of knowing if the dump was generated on a x64 machine or x86 machines?

Upvotes: 6

Views: 5612

Answers (4)

shluvme
shluvme

Reputation: 863

You can use the .effmach command to know the architecture that the dump was created on. Note that there is the WOW64 scenario where the dump arch is x64 but you should actually debug it with a x86 approach (see !wow64exts.sw command).

0:000> .effmach Effective machine: x64 (AMD64)

Upvotes: 3

UJ Choi
UJ Choi

Reputation: 31

Unfortunately, above answers don't work in most cases.

Dupmchk.exe will say "x86 compatible" for both x86 and x64 OS if the target process was built as x86 binary. And !peb command also gives you useless "PEB NULL..." for minidumps which we use most of the time.

You would better check the full path of "Kernel32.dll" since x64 OS will load "C:\Windows\Syswow64\Kernel32.dll" instead while x86 OS will load the plain "C:\Windows\System32\Kernel32.dll" for x86 executables. Loaded modules and their paths are recoreded in minidump and easily checked by dumpchk.exe, windbg and Visual Studio.

Upvotes: 3

Thierry Franzetti
Thierry Franzetti

Reputation: 1863

You can use the dumpchk.exe utility that ships with Debugging tools for Windows. Simply pass the dump file as the argument.

In the generated report, you'll have the OS version and the CPU flavor, for example :

Windows 7 Version 7601 (Service Pack 1) UP Free x64

Product: WinNt, suite: SingleUserTS

Upvotes: 1

seva titov
seva titov

Reputation: 11890

You can look at the environment variables. Output of command !peb, among other things, contains list of environment variables. If you see variables PROCESSOR_ARCHITEW6432 or ProgramW6432 defined, the OS is 64 bit. Otherwise, it is 32 bit.

Upvotes: 2

Related Questions