Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results

Finding the Computer Name in a Crash Dump (2018 Edition)

Finding the Computer Name in a Crash Dump (2018 Edition)

I was looking at a few different crashes today that were all eerily similar. In doing so, I realized that I hadn’t asked if these were all different systems or the same system. I could have just asked the person reporting the crashes, but what fun is that?

Prior to Windows 10, the computer name was readily available within the SRV module. It was even documented:

Aside: When you have a minute, check the link above and read how they suggest you find the IP address from the dump. It’s truly awesome (“Yeah, uhm, the IP address is probably on the stack somewhere…Have a nice day!!”).

Only trick is that the example x command doesn’t work with public symbols. You instead need to use dS for “Display Pointer to UNICODE_STRING”:

I discovered today that the srv!SrvComputerName trick no longer works on Windows 10. srv has been replaced with srv2 and there is no longer an SrvComputerName symbol:

Hoping that I might strike gold, I decided to search every module in the system for a symbol containing the string “ComputerName”:

Sadly, all of these were functions instead of simple globals containing the string. However, in doing a bit more digging I discovered that mrxsmb keeps a global array of pointers to UNICODE_STRING with the following:

  • Domain Name
  • Computer Name
  • Windows SKU + Build Number
  • Windows SKU + Version

Even better, this array exists back to at least Windows 7! So, this leads me to my new fancy way to get computer information from a crash dump:

Another example:

That command is, of course, impossible to remember. If you want sleaze out, you can instead just do a dpu mrxsmb!SmbCeContext. This simply dumps out PWCHARs starting at the given address, which can be close enough to give you the idea. The only important thing to note is that the strings displayed might not be properly NULL terminated.

Happy Debugging!