4

I've been looking for any Windows functions to view or dump memory, or the process to do this manually. I can not find info on this anywhere online.

How would I get a dump of a process's memory like the one in Olly's memory window?

Edit for clarification:

I wanted to be able to retrieve an address's base page address. The memory map was the best relation I had to this, as it gives page info such as size, starting address, permissions, etc. VirtualQueryEx() solved the problem.

I ended up iterating through the pages until I found one in which my target address fell.

I tend to ask for what I think would be the solution rather than laying out my problem and taking suggestions.

Thank you all for the help.

// Iterate through pages
for(base = NULL; 
    WINDOWS::VirtualQuery(base, info, sizeof(*info)) == sizeof(*info); 
    base += info->RegionSize) {

    if(p > base && p < base + info->RegionSize) {
        found = true;
        break;
    }
}
1
  • "I tend to ask for what I think would be the solution rather than laying out my problem and taking suggestions". The XY problem
    – osvein
    Commented Dec 5, 2017 at 21:49

2 Answers 2

7

VirtualQueryEx() can be used to scan through the user-mode address space of a process to enumerate each memory allocation, and PE headers of images in memory can be parsed to determine which memory blocks are associated with which PE sections. PE headers for DLLs also contain the DLLs' names.

1

To dump memory to a file, see the DbgHelp MiniDumpWriteDump function. You'll get a snapshot of the memory as a dump file (.DMP) which you can then analyze with various tools or by yourself using the DbgEng debugging engine.

2
  • 2
    If the downvoter could explain his vote I could learn not posting bad answers in the future. Thanks. Commented Mar 19, 2014 at 22:24
  • 1
    (Wasn't me) The OP's question was somewhat unclear; his title asked specifically about the memory map, but then he went on to ask generic questions about how to "view or dump memory". I'd say your answer addresses the latter part, but the real question was about the memory map, which Jason's answer would address. +1 for providing another approach. Commented Mar 26, 2014 at 6:06

Not the answer you're looking for? Browse other questions tagged or ask your own question.