minidump library determines pointer size based on ProcessorArchitecture. However, if the dumpfile is generated from a 32-bit process running on 64-bit machine (using wow64.dll), the pointer size will be 64bit, which is not the actual size of pointers in dump file memory.
Reproduce:
-
Run a 32-bit program on 64-bit os and create a minidump file.
-
Use python minidump to parse it. Pointer size and unpack format are not correct.
dump_reader = MinidumpFileReader(MinidumpFile.parse("test2.dmp"))
print(dump_reader.sizeof_ptr) # 8
print(dump_reader.unpack_ptr) # "<Q"
minidump library determines pointer size based on ProcessorArchitecture. However, if the dumpfile is generated from a 32-bit process running on 64-bit machine (using wow64.dll), the pointer size will be 64bit, which is not the actual size of pointers in dump file memory.
Reproduce:
Run a 32-bit program on 64-bit os and create a minidump file.
Use python minidump to parse it. Pointer size and unpack format are not correct.