mjsabby / copyonwritedump

Copy-on-write fork()-like memory dump using Process Snapshotting APIs

CoWDump

CopyOnWriteDump is a tool that uses the Process Snapshotting APIs available in Windows 8.1+ and Windows Server 2012 R2+ to capture full memory dumps of Win32 user-mode processes.

Process Snapshotting APIs use Copy-on-Write semantics to capture a "snapshot" of the target process. The target process is suspended for the duration of snapshot creation (its latency is usually orders of magnitude lower than capturing a full memory dump) and is then resumed.

Download

• 64-bit Processes: CopyOnWriteDump.exe
• 32-bit Processes (even when using on 64-bit Windows): CopyOnWriteDump32.exe

copyonwritedump's Issues

Does not work with 32-bit processes?

Another issue I have found is that 32-bit processes fail with an error 18136.

Do we need something special?

Cloned process is not killed after dump completes

Finally a working demo of the PSS APIs, thank you! This repository should be more popular imho!

However, there seems to be a bug that after the MiniDump is completed the Suspended Clone process hangs around indefinitely.

I noticed this after I created hundreds of snapshots and looked under Sys Internals Process Explorer.