DUMP进程内存保存文件

0xwangliang

于 2023-05-05 12:22:49 发布

阅读量314

点赞数 1

分类专栏： Windows 文章标签： windows 网络安全

本文链接：https://blog.csdn.net/misaka10046/article/details/130504306

版权

Windows 专栏收录该内容

19 篇文章 4 订阅

订阅专栏

代码

#include <Windows.h>
#include <TlHelp32.h>
#include <stdio.h>

// Dump a process' memory to a file
void dumpProcessMemory(DWORD pid, const char* filename) {
    HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, pid);
    if (hProcess == NULL) {
        printf("Failed to open process %d\n", pid);
        return;
    }

    // Get the process information
    PROCESSENTRY32 pe = { 0 };
    pe.dwSize = sizeof(pe);
    HANDLE hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
    if (Process32First(hSnapshot, &pe)) {
        do {
            if (pe.th32ProcessID == pid) {
                break;
            }
        } while (Process32Next(hSnapshot, &pe));
    }
    CloseHandle(hSnapshot);

    // Create the output file
    FILE* fp = fopen(filename, "wb");
    if (fp == NULL) {
        printf("Failed to create file %s\n", filename);
        CloseHandle(hProcess);
        return;
    }

    // Loop through all memory regions in the process and write them to the file
    MEMORY_BASIC_INFORMATION mbi;
    SIZE_T bytesRead;
    for (LPVOID address = NULL; VirtualQueryEx(hProcess, address, &mbi, sizeof(mbi)) == sizeof(mbi); address = (LPBYTE)mbi.BaseAddress + mbi.RegionSize) {
        if (mbi.State != MEM_FREE) {
            // Allocate a buffer for this memory region and read the data from the process
            LPVOID buffer = VirtualAlloc(NULL, mbi.RegionSize, MEM_COMMIT, PAGE_READWRITE);
            ReadProcessMemory(hProcess, mbi.BaseAddress, buffer, mbi.RegionSize, &bytesRead);

            // Write the memory contents to the file
            fwrite(buffer, 1, mbi.RegionSize, fp);

            // Free the buffer
            VirtualFree(buffer, 0, MEM_RELEASE);
        }
    }

    fclose(fp);
    CloseHandle(hProcess);

    printf("Dumped process %s (pid=%d) memory to file %s\n", pe.szExeFile, pid, filename);
}

int main(int argc, char** argv) {
    if (argc != 2) {
        printf("Usage: dumpmem <pid>\n");
        return 1;
    }

    DWORD pid = atoi(argv[1]);
    dumpProcessMemory(pid, "memory.bin");

    return 0;
}