4

I've been looking for any Windows functions to view or dump memory, or the process to do this manually. I can not find info on this anywhere online.

How would I get a dump of a process's memory like the one in Olly's memory window?

Edit for clarification:

I wanted to be able to retrieve an address's base page address. The memory map was the best relation I had to this, as it gives page info such as size, starting address, permissions, etc. VirtualQueryEx() solved the problem.

I ended up iterating through the pages until I found one in which my target address fell.

I tend to ask for what I think would be the solution rather than laying out my problem and taking suggestions.

Thank you all for the help.

// Iterate through pages
for(base = NULL; 
    WINDOWS::VirtualQuery(base, info, sizeof(*info)) == sizeof(*info); 
    base += info->RegionSize) {

    if(p > base && p < base + info->RegionSize) {
        found = true;
        break;
    }
}

closed as unclear what you're asking by perror, 0xC0000022L, ixje, jvoisin, broadway Mar 31 '14 at 15:43

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • "I tend to ask for what I think would be the solution rather than laying out my problem and taking suggestions". The XY problem – osvein Dec 5 '17 at 21:49
7

VirtualQueryEx() can be used to scan through the user-mode address space of a process to enumerate each memory allocation, and PE headers of images in memory can be parsed to determine which memory blocks are associated with which PE sections. PE headers for DLLs also contain the DLLs' names.

1

To dump memory to a file, see the DbgHelp MiniDumpWriteDump function. You'll get a snapshot of the memory as a dump file (.DMP) which you can then analyze with various tools or by yourself using the DbgEng debugging engine.

  • 2
    If the downvoter could explain his vote I could learn not posting bad answers in the future. Thanks. – Thomas Weller Mar 19 '14 at 22:24
  • 1
    (Wasn't me) The OP's question was somewhat unclear; his title asked specifically about the memory map, but then he went on to ask generic questions about how to "view or dump memory". I'd say your answer addresses the latter part, but the real question was about the memory map, which Jason's answer would address. +1 for providing another approach. – Jonathon Reinhart Mar 26 '14 at 6:06

Not the answer you're looking for? Browse other questions tagged or ask your own question.