Search notes:

Registry: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AeDebug

The registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AeDebug (or rather its value Debugger) specifies the post mortem debugger which is the debugger that is started if an application stops responding (for example after an access violation).
Typical values that might be found for Debugger include

Debugger

The value of Debugger is a command line that starts the debugger.
Up to three values are passed (printf) to the command line:

Auto

The value of Auto specifies if the debugger (command line) that is set in Debugger is automatically started or if a confirmation message box is first displayed.

JIT_DEBUG_INFO

The JIT_DEBUG_INFO struct is defined as follows:
typedef struct _JIT_DEBUG_INFO {
    DWORD dwSize;
    DWORD dwProcessorArchitecture;
    DWORD dwThreadID;
    DWORD dwReserved0;
    ULONG64 lpExceptionAddress;
    ULONG64 lpExceptionRecord;
    ULONG64 lpContextRecord;
} JIT_DEBUG_INFO, *LPJIT_DEBUG_INFO;
The dt JIT_DEBUG_INFO command also displays this structure.

See also

The -iaec command line option and the .jdinfo command xof the debugging tools for Windows.
The Sysinternals utility ProcDump can also be used for post mortem dump capture.

Index