{"componentChunkName":"component---src-templates-post-template-js","path":"/windows-setting-fulldump-en","result":{"data":{"markdownRemark":{"id":"a5db78c0-5e72-5187-95cf-a71e3a19c677","html":"
\n

This page has been machine-translated from the original page.

\n
\n

I got tired of manually configuring full memory dump collection every time, so I wrote a PowerShell script to automate the settings.

\n

The basic settings are based on the following official blog post.

\n

Reference: Configuring Complete Memory Dump Output | Microsoft Japan Windows Technology Support Blog

\n

In addition to configuring full memory dump collection, I also changed the user-mode process dump settings so that full dumps can be collected, based on the following public documentation.

\n

Reference: Collecting User-Mode Dumps - Win32 apps | Microsoft Learn

\n

The script is below.

\n

You can also download it from EnableFulldump.ps1.

\n

Administrator privileges are required to run it.

\n
# Settings of Full memory dump\n$crashControlRegPath = \"HKLM:System\\CurrentControlSet\\Control\\CrashControl\"\n$isExistKey = Test-Path -LiteralPath $crashControlRegPath\nif ($isExistKey -eq $False) {\nNew-Item -Path $crashControlRegPath\n}\nNew-ItemProperty -LiteralPath $CrashControlRegPath -Name \"CrashDumpEnabled\" -PropertyType \"DWord\" -Value \"1\" -Force\nNew-ItemProperty -LiteralPath $CrashControlRegPath -Name \"AutoReboot\" -PropertyType \"DWord\" -Value \"1\" -Force\nNew-ItemProperty -LiteralPath $CrashControlRegPath -Name \"DumpFile\" -PropertyType \"ExpandString\" -Value \"%SystemRoot%\\FULL_MEMORY.DMP\" -Force\nNew-ItemProperty -LiteralPath $CrashControlRegPath -Name \"LogEvent\" -PropertyType \"DWord\" -Value \"1\" -Force\n\n# Settings of Full application dump\n$localDumpsRegPath = \"HKLM:SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\LocalDumps\"\n$isExistKey = Test-Path -LiteralPath $localDumpsRegPath\nif ($isExistKey -eq $False) {\nNew-Item -Path $localDumpsRegPath\n}\nNew-ItemProperty -LiteralPath $localDumpsRegPath -Name \"DumpFolder\" -PropertyType \"ExpandString\" -Value \"%LOCALAPPDATA%\\CrashDumps\" -Force\nNew-ItemProperty -LiteralPath $localDumpsRegPath -Name \"DumpCount\" -PropertyType \"DWord\" -Value \"2\" -Force\nNew-ItemProperty -LiteralPath $localDumpsRegPath -Name \"DumpType\" -PropertyType \"DWord\" -Value \"2\" -Force\n\n# Disable CrashOnCtrlScroll\n$parameterRegPaths = @(\"HKLM:System\\CurrentControlSet\\Services\\i8042prt\\Parameters\",\n  \"HKLM:System\\CurrentControlSet\\Services\\kbdhid\\Parameters\",\n  \"HKLM:System\\CurrentControlSet\\Services\\hyperkbd\\Parameters\"\n)\nforeach ($parameterRegPath in $parameterRegPaths) {\n$isExistKey = Test-Path -LiteralPath $parameterRegPath\nif ($isExistKey -eq $False) {\nNew-Item -Path $parameterRegPath\n}\nNew-ItemProperty -LiteralPath $parameterRegPath -Name \"CrashOnCtrlScroll\" -PropertyType \"DWord\" -Value \"0\" -Force\n}\n\n# Setting alt dump key\n$parameterRegPaths = @(\"HKLM:System\\CurrentControlSet\\Services\\i8042prt\\crashdump\",\n  \"HKLM:System\\CurrentControlSet\\Services\\kbdhid\\crashdump\",\n  \"HKLM:System\\CurrentControlSet\\Services\\hyperkbd\\crashdump\"\n)\nforeach ($parameterRegPath in $parameterRegPaths) {\n$isExistKey = Test-Path -LiteralPath $parameterRegPath\nif ($isExistKey -eq $False) {\nNew-Item -Path $parameterRegPath\n}\nNew-ItemProperty -LiteralPath $parameterRegPath -Name \"Dump1Keys\" -PropertyType \"DWord\" -Value \"0x2\" -Force\nNew-ItemProperty -LiteralPath $parameterRegPath -Name \"Dump2Key\" -PropertyType \"DWord\" -Value \"0x3d\" -Force\n}\n\n# Change PageFileSize\n$totalPhysicalMemSize = $([Math]::Round((Get-WmiObject Win32_OperatingSystem).TotalVisibleMemorySize / 1024))\n$freeStorageSizeofC = $([Math]::Round(((Get-PSDrive C).Free / 1024 / 1024)))\n$pageFileSize = $totalPhysicalMemSize + 400\n$pageFileSetting = \"c:\\pagefile.sys $pageFileSize $pageFileSize\"\nif (($freeStorageSizeofC -gt $pageFileSize) -eq $True) {\nNew-ItemProperty -LiteralPath \"HKLM:System\\CurrentControlSet\\Control\\Session Manager\\Memory Management\" -Name \"PagingFiles\" -PropertyType \"MultiString\" -Value $pageFileSetting -Force\n} else {\nWrite-Warning \"C drive space is too small.\"\n}
\n

Note that the script above configures keyboard crashes in addition to full dump collection.

\n

The keyboard on the ThinkPad that I mainly use does not have a CtrlScroll key, so I configured an alternative key instead of CrashOnCtrlScroll.

\n

After applying the settings in the script above, reboot the OS and press [right CTRL + Space twice] to trigger a keyboard crash. After the system restarts, you can obtain the full dump from C:\\Windows\\FULL_MEMORY.DMP.

\n

Keyboard dump triggering does not work over an RDP connection or through a Hyper-V enhanced session, so you need to use the console or a tool such as NotMyFault.

","fields":{"slug":"/windows-setting-fulldump-en","tagSlugs":["/tag/win-dbg/","/tag/reversing/","/tag/english/"]},"frontmatter":{"date":"2023-07-25","description":"I created a PowerShell script to automate the configuration for collecting full dumps on Windows and for configuring keyboard crashes.","tags":["WinDbg","Reversing","English"],"title":"Use a PowerShell Script to Configure Windows Full Memory Dumps and Keyboard Crashes","socialImage":{"publicURL":"/static/43e9771c642ee0a3c999884b3f417f55/windows-setting-fulldump.png"}}}},"pageContext":{"slug":"/windows-setting-fulldump-en"}},"staticQueryHashes":["251939775","401334301","825871152"]}