mirror of https://github.com/x64dbg/btparser
83 lines
2.3 KiB
Plaintext
83 lines
2.3 KiB
Plaintext
|
//--------------------------------------
|
||
|
|
//--- 010 Editor v2.0.2 Binary Template
|
||
|
|
//
|
||
|
|
// File: DMPTemplate.bt
|
||
|
|
// Author: <a.schuster@yendor.net>
|
||
|
|
// Revision: 1.0 - 20060320
|
||
|
|
// Purpose: This template merely serves as documentation of the
|
||
|
|
// memory dump format used by Microsoft's debuggers and
|
||
|
|
// the NT kernel crashdump facility. Detailed and
|
||
|
|
// authorative information about a DMP file can be
|
||
|
|
// obtained by processing the file with the "dumpchk"
|
||
|
|
// utility which ships whith Microsoft's free debugging
|
||
|
|
// tools package.
|
||
|
|
//--------------------------------------
|
||
|
|
|
||
|
|
|
||
|
|
typedef enum <uint32> {
|
||
|
|
FULL = 1,
|
||
|
|
KERNEL,
|
||
|
|
SMALL
|
||
|
|
} e_DumpType;
|
||
|
|
|
||
|
|
|
||
|
|
typedef struct {
|
||
|
|
uint32 BasePage <format=hex>;
|
||
|
|
uint32 PageCount <format=hex>;
|
||
|
|
} _PHYSICAL_MEMORY_RUN32;
|
||
|
|
|
||
|
|
|
||
|
|
typedef struct {
|
||
|
|
uint32 NumberOfRuns;
|
||
|
|
uint32 NumberOfPages <format=hex>;
|
||
|
|
_PHYSICAL_MEMORY_RUN32 Run[NumberOfRuns];
|
||
|
|
} _PHYSICAL_MEMORY_DESCRIPTOR32;
|
||
|
|
|
||
|
|
|
||
|
|
typedef struct {
|
||
|
|
int32 ExceptionCode <format=hex>;
|
||
|
|
uint32 ExceptionFlags;
|
||
|
|
uint32 ExceptionRecord;
|
||
|
|
uint32 ExceptionAddress <format=hex>;
|
||
|
|
uint32 NumberParameters;
|
||
|
|
uint32 ExceptionInformation[15] <format=hex>;
|
||
|
|
} _EXCEPTION_RECORD32;
|
||
|
|
|
||
|
|
|
||
|
|
FSeek(0);
|
||
|
|
|
||
|
|
char Signature[4];
|
||
|
|
char ValidDump[4];
|
||
|
|
uint32 MajorVersion;
|
||
|
|
uint32 MinorVersion;
|
||
|
|
uint32 DirectoryTableBase <format=hex>;
|
||
|
|
uint32 PfnDataBase <format=hex>;
|
||
|
|
uint32 PsLoadedModuleList <format=hex>;
|
||
|
|
uint32 PsActiveProcessHead <format=hex>;
|
||
|
|
uint32 MachineImageType <format=hex>;
|
||
|
|
uint32 NumberProcessors;
|
||
|
|
uint32 BugCheckCode <format=hex>;
|
||
|
|
uint32 BugCheckParameter[4] <format=hex>;
|
||
|
|
char VersionUser[32];
|
||
|
|
uchar PaeEnabled;
|
||
|
|
uchar KdSecondaryVersion;
|
||
|
|
uchar Spare3[2];
|
||
|
|
uint32 KdDebuggerDataBlock <format=hex>;
|
||
|
|
_PHYSICAL_MEMORY_DESCRIPTOR32 PhysicalMemoryBlock;
|
||
|
|
FSeek(800);
|
||
|
|
uchar ContextRecord[1200];
|
||
|
|
_EXCEPTION_RECORD32 Exception;
|
||
|
|
char Comment[128];
|
||
|
|
uchar _reserved0[1768];
|
||
|
|
e_DumpType DumpType;
|
||
|
|
uint32 MiniDumpFields;
|
||
|
|
uint32 SecondaryDataState;
|
||
|
|
uint32 ProductType;
|
||
|
|
uint32 SuiteMask;
|
||
|
|
uint32 WriterStatus;
|
||
|
|
int64 RequiredDumpSpace;
|
||
|
|
uchar _reserved2[16];
|
||
|
|
FILETIME SystemUpTime;
|
||
|
|
FILETIME SystemTime;
|
||
|
|
uchar _reserved3[56];
|