debug 64bit dump of a 32bit process in windows 7 64bit

In Windows 7 the TaskMgr provides one easy way to create dump for the applications. You can right click the Application from Applications tab or click the process from Processes tab and click the Create Dump File menu item. The dump files will be created under certain folder soon. Here assume that we created one dump file for one of MaxWell consoles. If you load the dump file into Windbg and type “k” command, you will have below wired output.

 

0:000> k Child-SP          RetAddr           Call Site 00000000`0008e2e8 00000000`7458aea8 wow64win+0x3fe3a *** ERROR: Symbol file could not be found.  Defaulted to export symbols for wow64.dll - 00000000`0008e2f0 00000000`745dcf87 wow64win+0x1aea8 *** ERROR: Symbol file could not be found.  Defaulted to export symbols for wow64cpu.dll - 00000000`0008e350 00000000`74562776 wow64!Wow64SystemServiceEx+0xd7 00000000`0008ec10 00000000`745dd07e wow64cpu!TurboDispatchJumpAddressEnd+0x2d 00000000`0008ecd0 00000000`745dc549 wow64!Wow64SystemServiceEx+0x1ce 00000000`0008ed20 00000000`76e94956 wow64!Wow64LdrpInitialize+0x429 00000000`0008f270 00000000`76e91a17 ntdll!RtlUniform+0x6e6 00000000`0008f760 00000000`76e7c32e ntdll!RtlCreateTagHeap+0xa7 00000000`0008f7d0 00000000`00000000 ntdll!LdrInitializeThunk+0xe

 

This callstack looks quite strange to us. What the hell wow64!Wow64LdrpInitialize is?

 The reason why we have this strange callstack with this dump file is because we used the 64bit TaskMgr to create one 64bit dump for a 32-bit process. If you use the 64bit application such as 64bit TaskMrg or 64bit WinDBG to create the dump for a 32bit process, you will get a 64bit dump of a 32bit process. But how can we debug this 64bit dump of a 32bit process?

 We can make use of WOW64 debugger extension. You can find more information from below link:

http://msdn.microsoft.com/en-us/library/windows/desktop/aa384163(v=vs.85).aspx

 

0:000> .load wow64exts 0:000> !sw Switched to 32bit mode 0:000:x86> k ChildEBP          RetAddr           WARNING: Stack unwind information not available. Following frames may be wrong. 0031f280 6d5d88f7 user32!WaitMessage+0x15 0031f2d8 6d5d8741 System_Windows_Forms_ni+0x2088f7 0031f308 6d595911 System_Windows_Forms_ni+0x208741 0031f320 70f86739 System_Windows_Forms_ni+0x1c5911 0031f350 02341b4c NewConsole_ni+0x6739 0031f360 02358951 mscorwks+0x1b4c 0031f3e0 02375fbd mscorwks+0x18951 0031f518 02375ff0 mscorwks!CoUninitializeEE+0x11861 0031f534 0237600e mscorwks!CoUninitializeEE+0x11894 0031f54c 02414675 mscorwks!CoUninitializeEE+0x118b2

 

Windows also provides one 32bit TaskMgr which is C:\Windows\SysWOW64\taskmgr.exe. You can create a 32bit dump for 32bit process. With that 32bit dump we don’t need the WOW64 extension when we loaded it into WinDBG.