Ecosyste.ms: Awesome
An open API service indexing awesome lists of open source software.
https://github.com/tedyyu/ProcDumpEx
ProcDumpEx = ProcDump in batch mode
https://github.com/tedyyu/ProcDumpEx
Last synced: 3 months ago
JSON representation
ProcDumpEx = ProcDump in batch mode
- Host: GitHub
- URL: https://github.com/tedyyu/ProcDumpEx
- Owner: tedyyu
- License: mit
- Created: 2019-06-24T09:11:46.000Z (over 5 years ago)
- Default Branch: master
- Last Pushed: 2020-04-13T07:03:01.000Z (over 4 years ago)
- Last Synced: 2024-05-07T00:35:34.909Z (6 months ago)
- Language: C#
- Homepage:
- Size: 13.7 KB
- Stars: 16
- Watchers: 2
- Forks: 5
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project
- awesome-hacking-lists - tedyyu/ProcDumpEx - ProcDumpEx = ProcDump in batch mode (C# #)
README
# ProcDumpEx
As you may know, sysinternals' [procdump](https://docs.microsoft.com/en-us/sysinternals/downloads/procdump) is a great tool to capture crash dump files when certain condition meets.
However, it can only work for one process at a time, by either pid or image name.
If there are more than one processes with the same name opened on your machine, it will just reports:
```
>procdump chrome.exe
ProcDump v9.0 - Sysinternals process dump utility
Copyright (C) 2009-2017 Mark Russinovich and Andrew Richards
Sysinternals - www.sysinternals.com
[17:17:17] Multiple processes match the specified name.
```
The same logic happens to "-w" option in that it only monitors the next ONE process started afterwards.
That's why I decide to enhance it with a new wrapper named ProcDumpEx. It can dump multiple processes in one single command. Use "-d" option I invented to work with existing processes, and "-w" option to wait for certain processes. You can also use all the existing options provided by procdump utility.
**NOTE: This tool uses WMI to check new process event and thus need *administrative* priviledge to run. You can download the executable from the release tab.
Here are some examples:
1. Dump all the running notepad.exe processes
```
procdumpex -ma -e -d notepad.exe
```
2. Dump all notepad.exe processes started from now on
```
procdumpex -ma -e -w notepad.exe
```
3. Combine both cases above
```
procdumpex -ma -e -w notepad.exe -d notepad.exe
```
You can list multiple process names with comma separated in one command.
4. Dump all notepad.exe and calc.exe started later on when they use more than 30% CPU for 3 seconds
```
procdumpex -ma -e -c 30 -s 3 -w "notepad.exe,calc.exe"
```
A more realistic example is to dump process when a performance counter hits (-p option provided by procdump), for example:
5. Dump following processes when the system total CPU hits 80%.
```
procdumpex -ma -e -s 2 -n 3 -w "chrome.exe,wmplayer.exe" -d "chrome.exe,wmplayer.exe" -p "\Processor(_Total)\% Processor Time" 80 C:\temp\dump\PROCESSNAME_PID_YYMMDD_HHMMSS.dmp
```
6. Dump all (actually up to 100) first chance exceptions (-e 1) of a deferred launched image names.
```
ProcDumpEx.exe -ma -e 1 -n 100 -w foobar.exe
```
Another good feature is you just need to click CTRL+C to clean up all command windows that are opened.