I'm not sure I understand the purpose of the --backtrace-all. There's no way you can ensure a complete synchro between all threads & processes to get a global picture of the whole system, so the option is likely not very useful (except for the threads which are in a wait operation), but you will miss some other information for that (ie an event (entering/leaving CS...) tracker tool would be better). More over, I don't like either adding options to winedbg. So, I'd prefer adding an option to actually process the commands from a file (or even a string from command line) would be better. And, finally, you leak the handle for the snapshot. A+