In the previous introductory article we’ve discussed crash dump capturing and debugging of guest Windows with built-in tools. This post address a case when Windows can’t produce the Complete Memory Dump during BSoD by itself or a live dump is needed. We will discuss QEMU’s command dump-guest-memory -w which captures guest Windows dump in WinDbg-readable DMP format and saves it on the host side.
