Do minidump files contain the timestamp of the crash?

The MiscInfoStream in a minidump file contains the process create time. I'd like to find out how long the process has been running for before the crash. Does a minidump file contain the exception timestamp anywhere?

WinDbg on this dump file displays the following, which implies that it's in there somewhere...

Debug session time: Tue Dec 29 15:49:20.000 2009 (GMT+0)
System Uptime: not available
Process Uptime: 0 days 0:33:03.000

(DumpChk displays the same information, at the end of the list of streams)

Note that today's Mar 15, so this is almost certainly the timestamp of the crash. I'd like a programmatic way 开发者_Python百科to retrieve that value and the "Process Uptime" value.

I found the MINIDUMP_MISC_INFO_3 structure, which contains some timezone information, but it doesn't seem to contain the exception time.

Some dump files appear to have a ThreadInfoListStream, which contains the timestamps for each thread in the process, but this isn't included in the minidumps that I've seen.

You can get the values for the crash time and the process up time using the dbgeng api. See the Windbg sdk directory for the dumpstk sample - you can modify it to get at this information.

My code below assumes you've added a new query interface for the system objects 2 interface into a new global g_SysObjects.

IDebugSystemObjects2* g_SysObjects;

and changed g_Control from IDebugControl to IDebugControl2.

#include <time.h>
void DumpUpTimeAndCrashTime()
{
    ULONG upTime = 0;

    g_SysObjects->GetCurrentProcessUpTime(&upTime);
    int days = upTime / (60*60*24);
    int hours = (upTime % (60*60*24)) / (60*60);
    int minutes = (upTime % (60*60))/60;
    int seconds = upTime % 60;
    printf("Process uptime %d days %02d:%02d:%02d.000\n", 
            days, hours, minutes, seconds);

    ULONG crashTime = 0;
    g_Control->GetCurrentTimeDate(&crashTime);
    time_t ct = crashTime;
    printf( "Crash time and date: %s", _ctime64( &ct ) );
}

I don't think the time of the exception is stored anywhere in the minidump file. The exception structure certainly does not contain this info: http://msdn.microsoft.com/en-us/library/ms680367%28VS.85%29.aspx

The misc info struct does contain the process start time, but not the exception time: http://msdn.microsoft.com/en-us/library/ms680389%28VS.85%29.aspx

You can see all the possible contents of a minidump here: http://msdn.microsoft.com/en-us/library/ms680394%28v=VS.85%29.aspx