Extract process dump from full memory dump

Question

I've reached a bug, but I was unable to create a process dump. I've created a full memory dump of system. How could I extract a process dump using it?
Windows.

Watermark

Answer 1

You cannot. In general, some of the memory segments that belong to your process could be paged out and not resident in physical memory. This means that with full kernel memory dump you are not guaranteed to reconstruct process address space.

In many cases you can extract useful information about process from kernel dump. However there are two limitations:

1. Memory can be paged out, as I already mentioned.
2. Many WinDbg extensions won't work with kernel dump. This includes SOS, so investigating managed processes are much more difficult from kernel space.

Adao