8

I am investigating a BSOD and I'd like to know more about the process that caused the problem. I can open the minidump in WinDbg which gives a lot of information about the crash. However the one piece of information I haven't been able to get is the command line arguments of the process that caused the crash.

Does anyone know if it is something that can be extracted from a crash dump?

Thanks in advance.

Clem
  • 181

1 Answers1

10

The information I was looking for is stored in the process environment block (PEB). In WinDbg the !peb command displays a formatted view of the PEB. This view contains an entry for the command line that was used to start the process.

Clem
  • 181