Postmortem Debugging

You prepare and execute postmortem debugging in much the same way you prepare for live debugging, including settings for GFlags. The main difference is that you do not run the program in the debugger or attach the debugger to the program after it starts. Instead, you run the program as intended, but use GFlags to designate a debugger that the system will attach to the program if there is an error. The advantage of this procedure is that you can minimize the effect upon program execution of your preparations for debugging.

1. Set standard heap options with a designated debugger:

   GFlags /p /enable Program.exe /debug WinDbg.exe

2. Run your program.
3. Wait for an error to occur. The error might be an Application Verify Stop, an Access Violation, a Memory Check Error, or any other error type severe enough to force the operation system to attach the debugger to the process and bring it up at a breakpoint. Then you can either analyze the error online as in any other debug session, or evaluate the error offline.

   To evaluate the error offline, you can pull a memory dump by typing the following into the WinDbg command line:

   .dump /ma Filename.dmp

4. Click Stop Debugging in the WinDbg toolbar. This will halt the program and empty the debug window.
5. Clear the heap options:

   GFlags /p /disable Program.exe