title: Getting detailed version information of the executed program
body: <p>I'm trying to get the version information of the executable from a crash dump. It's not that simple, so please read the whole question before you come up with an answer that does not work.</p>
  
  <h3>lm vm appname</h3>
  
  <p>Basically I can do <code>lmv</code> to get the version details, and that is exactly the information I want.</p>
  
  <p>If you don't know how to get the version information of the executable, you can google a bit and get <a href="https://social.msdn.microsoft.com/Forums/en-US/a3f73d8b-1d0b-49d6-951e-edcdf485bebc/windbg-how-to-get-version-info-for-the-exe-from-which-a-dump-file-was-generated?forum=windbg" rel="nofollow noreferrer">this answer</a>, which suggests</p>
  
  <blockquote>
    <p><code>lm vm appname</code> (without .exe)</p>
  </blockquote>
  
  <p>This works probably in 90% of the cases. However, it has the following two issues which I want to resolve in an automated analysis:</p>
  
  <ol>
  <li>What is <code>appname</code> if I don't know the executable in advance?</li>
  <li>In special cases like Notepad++, the module name is not <code>notepad++</code> but rather <code>notepad__</code></li>
  </ol>
  
  <p>Now I <em>can</em> find out the executable name using <code>|</code>, but extracting the name of the executable from that output is not trivial.</p>
  
  <h3>Finding the exe in the list of modules</h3>
  
  <p>It is possible to find executables in the list of modules with a command like</p>
  
  <pre><code>.shell -ci "lmf" findstr "\.exe"
  </code></pre>
  
  <p>We can then extract the address and list the details with</p>
  
  <pre><code>.foreach /ps 9999 (exe {.shell -ci "lmf" findstr "\.exe"}) {lmva exe}
  </code></pre>
  
  <p>Still, there is a problem: .NET processes can load assemblies that are not DLLs but EXEs. In that case, the output might be wrong if the first result is not the main executable but a EXE loaded later.</p>
  
  <h3>List of modules</h3>
  
  <p>It is possible to get a list of modules using <code>lm1m</code>. And usually, the first one in that list is the executable.</p>
  
  <p>It is then possible to extract the first line and get the details for it. A command looks like</p>
  
  <pre><code>.foreach /ps 9999 (exe {lm1m}) { lm vm ${exe}}
  </code></pre>
  
  <p>Unfortunately, it is not guaranteed that the executable is the first module. The modules are sorted by address. And IMHO it might happen that the executable is loaded at a higher address.</p>
  
  <h3>Question</h3>
  
  <p>How do I get <code>lmv</code> information for the main executable reliably.</p>
  
  <p>Assumptions that can be made:</p>
  
  <ul>
  <li>user mode crash dump of type <code>/ma</code></li>
  <li>only one process is being debugged</li>
  </ul>