ModuleRescue can generate executable modules (.EXEs and .DLLs) from the module information stored in minidumps. The modules produced by the application are enough to let debuggers download symbols from the symbol server even if the real matching module is not available. It is useful in the situation when, while debugging a minidump, we cannot find matching module but know that symbols for the module are available on the symbol server. You can find more detailed description of module matching and related issues in this article.
ModuleRescue can also display module information stored in the minidump. You can use it to view the list of modules loaded by the application at the time when the minidump was created, and analyze such information as module load address, file and product version, availability of debug information.
A simple command line version of ModuleRescue is also available. It can be found here.
When to use ModuleRescue
When we debug a minidump, the debugger needs access to the exact same versions of executable modules as were loaded by the target process at the time when the dump was created. If the debugger cannot find matching module, it cannot load symbols for the module and as a result it often cannot display meaningful call stack information, thus limiting the possibility of successful debugging. While it is usually not difficult to ensure that executable modules built by ourselves are stored in a safe location and can be found when we need to debug a minidump, it is more difficult to find matching modules for operating system and 3rd party modules.
Fortunately, Windows XP and Windows Server 2003 system modules can be downloaded from the symbol server. But if the minidump was created on Windows 2000 or older system, we can find ourselves in the situation when we cannot find the matching system DLL but at the same time we know that its symbols should be available on the symbol server. If we could download only the symbols and ask the debugger to use them without looking for matching module, we would be able to see good call stacks in the debugger. But, unfortunately, existing debuggers (VS.NET and WinDbg) do not allow it.
ModuleRescue allows to work around this problem. Its functionality is based on the fact that minidumps often contain enough information to identify the basic characteristics of a module, such as debug information record. ModuleRescue reads this information from the minidump and generates dummy modules that can be recognized by debuggers as matched. After debuggers have recognized the modules as matched, they can proceed with downloading their symbols.
How to use ModuleRescue
1. Open the minidump.
You can enter the name of the minidump file in Minidump field, or you can browse for the file.
2. View the list of modules.
After the minidump has been loaded, ModuleRescue will display the list of modules loaded by the application at the time when the minidump was created. If you select a module, the application will display various information about the module (its load address, size, timestamp, checksum, file and product versions, and debug information format if it is available). You can analyze this information and decide which modules should be generated.
3. Specify the output directory.
By default, generated modules will be stored in the same directory with ModuleRescue executable. If you want to store the generated modules in another location, enter the path in Output Dir field or browse for the needed directory.
4. Generate modules.
Select a module in the module list and press Generate button (or simply Enter) to generate the module. ModuleRescue will generate the module and store it in the specified output directory.
5. Let the debugger know where the modules are stored.
To be able to load symbols for the modules generated by ModuleRescue, the debugger should be able to find them on the module search path. Module search path configuration differs for various existing debuggers, and you can find detailed information about it in this article.
Supported operating systems
ModuleRescue works on Windows NT 4.0, Windows 2000, Windows XP and Windows Server 2003.
If something fails during module generation process, ModuleRescue will report an error. The error description usually contains the reason of the error, sometimes together with Win32 error code. You can use Error Lookup utility (supplied with Visual Studio) to obtain more information about the error code.
Note: Generated modules cannot run correctly
Modules generated by ModuleRescue contain enough information to make debuggers believe that they match the given minidump and can be used to download symbols. At the same time, they do not contain valid executable code and cannot be used as substitutes for the real modules in situations not related to minidump debugging.
Download ModuleRescue (470 Kb)