kdmp-parser 0.6.0

A Cross-Platform C++ parser library for Windows kernel minidumps.

Python building for kdmp-parser

This C++ library parses Windows kernel full dumps (.dump /f in WinDbg) as well as BMP dumps (.dump /ka in WinDbg).

The library supports loading 64-bit dumps and provides read access to things like:

• The context record,
• The exception record,
• The bugcheck parameters,
• The physical memory.

The Python bindings were authored by hugsy & masthoon. Refer to the project page on Github for documentation, issues and pull requests.

Installing from PyPI

The easiest way is simply to:

pip install kdmp_parser

Examples

Get context, print the program counter

import kdmp_parser
dmp = kdmp_parser.KernelDumpParser("full.dmp")
assert dmp.type == kdmp_parser.DumpType.FullDump
ctx = dmp.context
print(f"Dump RIP={ctx.Rip:#x}")

Read a virtual memory page at address pointed by RAX

import kdmp_parser
dmp = kdmp_parser.KernelDumpParser("full.dmp")
dmp.read_virtual_page(ctx.Rax)

Explore the physical memory

import kdmp_parser
dmp = kdmp_parser.KernelDumpParser("full.dmp")
pml4 = dmp.directory_table_base
print(f"{pml=:#x}")
dmp.read_physical_page(pml4)

Translate a virtual address into a physical address

import kdmp_parser
dmp = kdmp_parser.KernelDumpParser("full.dmp")
VA = dmp.Rip
PA = dmp.translate_virtual(VA)
print(f"{VA=:#x} -> {PA=:#x}")

Build

Run the following after installing CMake and Python 3.8+ / pip:

pip install -r src/python/requirements.txt
pip install src/python

Authors

• Axel '@0vercl0k' Souchet

Contributors