C ++：转储RAM内容 [英] C++: Dump RAM contents

问题描述

• 如何在不触发访问冲突的情况下实现？

指针设置到特定的开始位置，然后逐步递增。这会导致访问冲突。

I have tried having a bool pointer set to a specific start location and then incrementing it step by step. This results in an access violation.

我使用Visual Studio 2010

I'm using Visual Studio 2010

推荐答案

Windows是一个虚拟内存操作系统。这意味着软件处理内存 - 这可能或可能不会在某个时间点缓存在RAM中。相当多的进程内存可能存储在磁盘上 - 在页面文件中，或作为文件映射的一部分。

Windows is a virtual memory operating system. Which means that software deals with "memory" - which may, or may not, be cached in RAM at some point in time. Quite a lot of a processes memory is probably stored on disk - in the pagefile, or as part of a file mapping.

那么，如果你从dumping RAM 到倾销内存，那么你需要问自己哪个内存。

So then, if you downgrade from "dumping RAM" to "dumping memory", then you need to ask yourself "which memory".

除了作为虚拟内存操作系统，Windows还保护应用程序，每个进程获得它们自己的专用地址空间用于内存。所以，你需要决定你想要转储什么内存。我们自己的过程？这很容易。使用VirtualQuery检查块并将其转储出来。

In addition to being a virtual memory OS, Windows also protects applications from each other - each process gets their own private address space for memory. So, you need to decide what memory you want to dump. our own process? Thats easy. Use VirtualQuery to examine the blocks and dump them out.

查看另一个进程？这更复杂。有一些安全障碍阻止不受信任的应用程序查找更多的可信进程内存。如果你有足够的权限，VirtualQueryEx会让你检查另一个进程。

Looking at another process? Thats more complicated. There are security barriers that prevent untrusted applications from looking into more trusted processes memory. VirtualQueryEx will let you examine another process if you have sufficient rights.

最后，如果你想检查内核内存，你需要开发一些驱动程序：Usermode代码根本不允许查看内核内存。

Finally, if you want to examine the kernel memory, then you need to develop some kind of driver: Usermode code is not allowed to look at kernel memory at all.

这篇关于C ++：转储RAM内容的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！