This repository has been archived by the owner on May 31, 2020. It is now read-only.
-
Notifications
You must be signed in to change notification settings - Fork 44
/
Copy pathProcdump.ps1
80 lines (72 loc) · 2.13 KB
/
Procdump.ps1
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
<#
.Synopsis
Writes a minidump for the specified process.
.DESCRIPTION
Writes a minidump for the specified process. When no path is specified the dump will be placed
in the current directory with the name of the process and a time stamp.
.EXAMPLE
Get-Process Notepad | Out-MiniDump -Path C:\MyDump.dmp -Full
#>
function Out-MiniDump
{
[CmdletBinding()]
param(
# The process to take a memory dump of.
[Parameter(ValueFromPipeline=$True, Mandatory=$true)]
[System.Diagnostics.Process]$Process,
# The path output the minidump to
[Parameter()]
[string]$Path,
# Whether to take a full memory dump
[Parameter()]
[Switch]$Full,
# Force the overwrite of an existing dump
[Parameter()]
[Switch]$Force
)
Process
{
if ([String]::IsNullOrEmpty($Path))
{
$MS = [DateTime]::Now.Millisecond
$Path = Join-Path (Get-Location) "$($Process.ID)_$MS.dmp"
}
if (-not $Force -and (Test-Path $Path))
{
throw "$Path already exists. Use the -Force parameter to overwrite and existing dmp file."
}
elseif ($Force -and (Test-Path $Path))
{
Remove-Item $Path -Force | Out-Null
}
if ($Full)
{
$DumpType = [PoshInternals.MINIDUMP_TYPE]::MiniDumpWithFullMemory
}
else
{
$DumpType = [PoshInternals.MINIDUMP_TYPE]::MiniDumpNormal
}
$FileStream = $null
try
{
Write-Verbose "Dump File Path [$Path]"
$FileStream = New-Object -TypeName System.IO.FileStream -ArgumentList $Path,'CreateNew','Write','None'
}
catch
{
Write-Error $_
return
}
if (-not $FileStream)
{
throw New-Object System.ComponentModel.Win32Exception
}
if (-not [PoshInternals.DbgHelp]::MiniDumpWriteDump($Process.Handle, $Process.Id, $FileStream.Handle, $DumpType, [IntPtr]::Zero, [IntPtr]::Zero, [IntPtr]::Zero))
{
$FileStream.Dispose()
throw New-Object System.ComponentModel.Win32Exception
}
$FileStream.Dispose()
}
}