Skip to content

Instantly share code, notes, and snippets.

@luca-m
Last active October 16, 2018 16:01
Show Gist options
  • Save luca-m/4b6740f167591b6c4c24a1294fb2cbf6 to your computer and use it in GitHub Desktop.
Save luca-m/4b6740f167591b6c4c24a1294fb2cbf6 to your computer and use it in GitHub Desktop.
windbg snippets
# https://blogs.msdn.microsoft.com/benjaminperkins/2017/04/03/dumping-modules-from-a-memory-dump-for-decompilation/
.load C:\Program Files\dotnet\shared\Microsoft.NETCore.App\2.0.5\sos.dll
!for_each_module .if ($spat ("${@#ImageName}","*.exe")) { !SaveModule ${@#Base} D:\MemoryDumps\anything\exes\${@#ModuleName}.exe } .else { !SaveModule ${@#Base} D:\MemoryDumps\anything\dlls\${@#ModuleName}.dll }
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment