Type Definition memflow_coredump::CoreDump

type CoreDump<'a> = ReadMappedFilePhysicalMemory<'a>;

The parse_file function reads and parses Microsoft Windows Coredump files.

When opening a crashdump it tries to parse the first 0x2000 bytes of the file as a 64 bit Windows Coredump. If the validation of the 64 bit Header fails it tries to read the first 0x1000 bytes of the file and validates it as 32 bit Windows Coredump.

If neither attempt succeeds the function will fail with an Error::Conector error.

create_connector function attempts to directly create a connector (based on crate configuration - mmap or stdio based).

Examples

use std::path::PathBuf;

use memflow::connector::ConnectorArgs;
use memflow_coredump::create_connector;

let path = PathBuf::from(env!("CARGO_MANIFEST_DIR"))
    .join("resources/test/coredump_win10_64bit_stripped.raw");
if let Ok(mut mem) = create_connector(&ConnectorArgs::with_default(path.to_str().unwrap())) {
    println!("Coredump connector initialized");
}