ÇReadProcessMemory - 如何检查与过程相关联的存储器区域 [英] C ReadProcessMemory - how to examine the memory area associated with a process

问题描述

我广域网阅读所有与特定进程相关联的内存。我知道ReadProcessMemory的函数，但因为我有使用它的经验不多，我很害怕，我只会得到倒垃圾的负载（垃圾中...）。

I wans to read all of the memory associated with a particular process. I am aware of ReadProcessMemory, but as I have little experience of using it and I am fearful that I will just get a load of rubbish out (rubbish in...).

一）我怎么工作了，从基本指针结束）的总区域，我可以读
二）什么是最好的方法/最安全的方式遍历这个领域内存和打印
三）我怎么打印出来给我不知道是什么值它将包含这样我可以看看吗？

a) how do I work out, from the base pointer to the end) the total region that I can read b) what is the best way/safest to iterate over this area of memory and print it c) how do I print it given that I don't know what values it will contain so that I can look at it?

我也想能够从内存中包括在我的输出每条数据的实际位置。

I would also like to be able to include the actual location of each piece of data from within memory in my output.

由于R上。

推荐答案

开始用的 VirtualQueryEx 来确定哪些进程的地址空间的部分已页面备份它们，那么一旦你知道什么是在那里，你可以使用的 ReadProcessMemory 来看看实际的数据。

Start with VirtualQueryEx to determine what parts of the process's address space have pages backing them up, then once you know what is where, you can use ReadProcessMemory to look at the actual data.

这篇关于ÇReadProcessMemory - 如何检查与过程相关联的存储器区域的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！