Windows Error Reporting activating LocalDumps in the short term

Developers have the situation that an application crashes and Windows already shows the Windows Error Reporting dialog. The previous article analyzed the influence of attaching a debugger while the dialog is shown. This article uses the Windows Registry to enable the LocalDumps feature just before the application is terminated.

Assume that the application crashed and is already showing the Windows Error Reporting dialog. While the system is waiting for your response, you can go to the Registry at the LocalDumps key (Windows Vista SP1 or higher) and make the necessary entries for saving crash dumps on hard disk.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps

I tried this and in fact got a crash dump written to disk. This is what it tells:

0:001> !findstack ntdll!DbgBreakPoint
0:001> *** There's no debug breakpoint injected
0:001> kn
 # ChildEBP RetAddr  
00 01b8f904 770715f7 ntdll!NtWaitForMultipleObjects+0x15
01 01b8f9a0 75b319f8 KERNELBASE!WaitForMultipleObjectsEx+0x100
02 01b8f9e8 75b34200 kernel32!WaitForMultipleObjectsExImplementation+0xe0
03 01b8fa04 75b580a4 kernel32!WaitForMultipleObjects+0x18
04 01b8fa70 75b57f63 kernel32!WerpReportFaultInternal+0x186
05 01b8fa84 75b57858 kernel32!WerpReportFault+0x70
06 01b8fa94 75b577d7 kernel32!BasepReportFault+0x20
07 01b8fb20 776574ff kernel32!UnhandledExceptionFilter+0x1af
08 01b8fb28 776573dc ntdll!__RtlUserThreadStart+0x62
09 01b8fb3c 77657281 ntdll!_EH4_CallFilterFunc+0x12
0a 01b8fb64 7763b499 ntdll!_except_handler4+0x8e
0b 01b8fb88 7763b46b ntdll!ExecuteHandler2+0x26
0c 01b8fbac 7763b40e ntdll!ExecuteHandler+0x24
0d 01b8fc38 775f0133 ntdll!RtlDispatchException+0x127
0e 01b8fc38 6f8c20ce ntdll!KiUserExceptionDispatcher+0xf
0f 01b8ff88 75b3338a FirstSteps+0x20ce
10 01b8ff94 77619f72 kernel32!BaseThreadInitThunk+0xe
11 01b8ffd4 77619f45 ntdll!__RtlUserThreadStart+0x70
12 01b8ffec 00000000 ntdll!_RtlUserThreadStart+0x1b
0:001> *** Callstack looks like the bad WER callstack from previous example
0:001> .exr -1
ExceptionAddress: 6f8c20ce (FirstSteps+0x000020ce)
   ExceptionCode: c000001d (Illegal instruction)
  ExceptionFlags: 00000000
NumberParameters: 0
0:001> *** But the exception is good
0:001> .frame 0f
0f 01b8ff88 75b3338a FirstSteps+0x20ce
0:001> u
FirstSteps+0x20ce:
6f8c20ce 0f0b            ud2
0:001> *** And changing the frame disassembles to the correct instruction

I have not found official documentation about the timing of the LocalDumps Registry key, so I can’t guarantee that this will work for all times. At least it worked on my Windows 7 SP1 x64 machine at the time of writing.