调试器如何使用ReadProcessMemory？ [英] How do debuggers work with ReadProcessMemory?

问题描述

据我的理解，调试器使用ReadProcessMemory（在Windows环境中）来读取另一个进程的内存..我想知道的是：ReadProcessMemory读取另一个进程的内存到缓冲区，从而导致开销。调试器读取小块内存，还是一次读取整个进程的内存？

It's my understanding that debuggers use ReadProcessMemory (in a Windows environment) to read another process' memory.. what am I wondering is: ReadProcessMemory reads another process' memory to a buffer so it causes overhead. Do debuggers read small chunks of memory or do they read the entire process' memory in one shot?

推荐答案

API不保证原子读。最终，它复制数据（相对于通过地址映射提供对原始字节的访问），如果调试对象仍在运行，则可能在API调用进行时改变所讨论的内存。

API does not guarantee atomic read. Eventually it copies data (as opposed to providing access to original bytes through address mapping), and if the debuggee is still running it might be altering the memory in question while the API call is in progress.

这篇关于调试器如何使用ReadProcessMemory？的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！