dumper — Dump core from WIN32PID to FILENAME.core


dumper [-n] [-d] [-q] FILENAME WIN32PID

dumper -h | -V


-n, --nokill   don't terminate the dumped process
-d, --verbose  be verbose while dumping
-h, --help     output help information and exit
-q, --quiet    be quiet while dumping (default)
-V, --version  output version information and exit


The dumper utility can be used to create a core dump of running Windows process. This core dump can be later loaded into gdb and analyzed.

If the core file size limit is set to unlimited (e.g. ulimit -c unlimited) and an error_start executable hasn't been configured in the CYGWIN environment variable, Cygwin will automatically run dumper when a fatal error occurs.

dumper can be also be started from the command line to create a core dump of any running process.

For historical reasons, unless the -n option is given, after the core dump is created and when the dumper exits, the target process is also terminated.

To save space in the core dump, dumper doesn't write those portions of the target process's memory space that were loaded from executable and dll files and are unchanged (e.g. program code). Instead, dumper saves paths to the files which contain that data. When a core dump is loaded into gdb, it uses these paths to load the appropriate files. That means that if you create a core dump on one machine and try to debug it on another, you'll need to place identical copies of the executable and dlls in the same directories as on the machine where the core dump was created.


A Cygwin "core dump file" is an ELF file containing the mutable parts of the process memory and special note sections which capture the process, thread and loaded module context needed to recreate the process image in a debugger.