First, let me thank you for the awesome tools!

I tried to use snapshot to create a full memory dump for wtf. I always ran into this error:

kd> p
toto_exe!main+0x292:
0033:00007ff6`3c1c94c2 ff15386b0900    call    qword ptr [toto_exe!_imp_DeviceIoControl (00007ff6`3c260000)]
kd> .load C:\Users\testq\Downloads\snapshot\snapshot.dll
kd> !snapshot c:\foo
[snapshot] Dumping the CPU state into c:\foo\state.22621.1.amd64fre.ni_release.220506-1250.20240320_1426\regs.json..
[snapshot] Dumping the memory state into c:\foo\state.22621.1.amd64fre.ni_release.220506-1250.20240320_1426\mem.dmp..
Creating c:\\foo\\state.22621.1.amd64fre.ni_release.220506-1250.20240320_1426\\mem.dmp - 

Press ctrl-c (cdb, kd, ntsd) or ctrl-break (windbg) to abort symbol loads that take too long.
Run !sym noisy before .reload to track down problems loading symbols.

Full memory range dump
0% written.
ValidateSequenceNumber: Sequence number too far ahead for validation.
Wrote 62.8 MB in 38 sec.
The average transfer rate was 1.7 MB/s.
Dump successfully written
[snapshot] Done!

However the dump is not valid (only 62.8MB written) and is not accepted by wtf:

 ..\wtf.exe fuzz --backend=bochscpu --name blah --limit 10000000
Initializing the debugger instance.. (this takes a bit of time)
OpenDumpFile(state\mem.dmp) failed with hr=-0x7ff8ffa9 # error code 87?

I have tried several times, and I sometimes get different errors:

kd> !snapshot c:\foo
[snapshot] Dumping the CPU state into c:\foo\state.22621.1.amd64fre.ni_release.220506-1250.20240320_1431\regs.json..
[snapshot] Dumping the memory state into c:\foo\state.22621.1.amd64fre.ni_release.220506-1250.20240320_1431\mem.dmp..
Creating c:\\foo\\state.22621.1.amd64fre.ni_release.220506-1250.20240320_1431\\mem.dmp - Full memory range dump
0% written.
ValidateKdPacket: Invalid packet leader. Expected 0x30303030, received 0x69696969.
ValidateKdPacket: Invalid packet leader. Expected 0x30303030, received 0x69696969.
ValidateKdPacket: Invalid packet leader. Expected 0x30303030, received 0x69696969.
ValidateKdPacket: Invalid packet leader. Expected 0x30303030, received 0x69696969.
ValidateKdPacket: Invalid packet leader. Expected 0x30303030, received 0x69696969.
Wrote 512.0 KB in 2 sec.
The average transfer rate was 256.1 KB/s.
Dump successfully written
[snapshot] Done!

I don't think those are bugs in snapshot but my setup must be wrong. Could you find errors in my setup or give more details about yours?

1. Userland app with system("PAUSE"); and then __debugbreak(); just before DeviceIoControl
2. I open toto.exe inside the guest
3. Windbg attached to the guest's kernel, I switch to toto.exe's context with .process /p /r <EPROCESS>
4. On the guest, I press ente to unpause toto.exe, this trigger __debugbreak();
5. In Windbg I step until the call to DeviceIoControl
6. Load snapshot.dll
7. Try to snapshot, fail, repeat.

My setup:

• Host and guest: Windows 11 23h2

• Guest runs inside VMWare.

• Windbg 1.2402.24001.0

Network debugging for kd

bcdedit /debug on
bcdedit /dbgsettings net hostip:172.16.9.13 port:50420 nodhcp

I also tried over Serial but it takes too long (2h for 16MB).

Makes for a nicer end-user experience :)

kd> !snapshot --help
[snapshot] Usage: snapshot <KIND> [STATE_PATH]

Arguments:
  <KIND>        The kind of snapshot to take [possible values: active-kernel, full]
  [STATE_PATH]  The path to save the snapshot to

Options:
  -h, --help  Print help

Those are the cases considered:

• If a path is given and it doesn't exist. In that case, we do not generate a folder name, the user must have provided the directory where they want us to dump the files.
• If a path is given and it does exist. In that case, we will generate a folder name for the user.
• No path is given in which case the resulting files will be created in the temp folder, in a directory we will create.