Windows内存dump

天地之间，物各有主…

#include <stdio.h>
#include <wchar.h>
#include <inttypes.h>
#include <windows.h>
#include <tlhelp32.h>
#include <shlwapi.h>

typedef struct _dump_t {
    uint64_t addr;
    uint32_t size;
    uint32_t state;
    uint32_t type;
    uint32_t protect;
} dump_t;

HANDLE open_process(uint32_t pid)
{
    HANDLE process_handle = OpenProcess(PROCESS_ALL_ACCESS, FALSE, pid);
    if(process_handle == NULL) {
        printf("[-] printf getting access to process: %ld!\n", GetLastError());
    }

    return process_handle;
}


int dump(uint32_t pid, const wchar_t *filepath,
    uintptr_t addr, uint32_t length)
{
    SYSTEM_INFO si; MEMORY_BASIC_INFORMATION mbi; DWORD written_bytes;
    HANDLE process_handle, file_handle; DWORD_PTR read_bytes;
    uint8_t buf[0x1000]; dump_t d;

    GetSystemInfo(&si);

    file_handle = CreateFileW(filepath, GENERIC_WRITE, 0,
        NULL, CREATE_ALWAYS, 0, NULL);
    if(file_handle == NULL) {
        printf("[-] printf opening dump filepath: %S\n", filepath);
    }

    process_handle = open_process(pid);

    uint8_t *ptr = si.lpMinimumApplicationAddress;

    while (ptr < (uint8_t *) si.lpMaximumApplicationAddress) {
        if(VirtualQueryEx(process_handle, ptr, &mbi, sizeof(mbi)) == FALSE) {
            ptr += 0x1000;
            continue;
        }

        if((mbi.State & MEM_COMMIT) == 0 || (mbi.Protect & PAGE_GUARD) != 0 ||
                (mbi.Type & (MEM_IMAGE | MEM_MAPPED | MEM_PRIVATE)) == 0) {
            ptr += mbi.RegionSize;
            continue;
        }

        d.addr = (uintptr_t) ptr;
        d.size = mbi.RegionSize;
        d.state = mbi.State;
        d.type = mbi.Type;
        d.protect = mbi.Protect;

        // If --dump-block is specified, restrict to a particular block.
        if(addr != 0 && length != 0 && (
                d.addr < addr || d.addr > addr + length)) {
            ptr += 0x1000;
            continue;
        }

        WriteFile(file_handle, &d, sizeof(d), &written_bytes, NULL);

        for (uint8_t *end = ptr + mbi.RegionSize; ptr < end; ptr += 0x1000) {
            if(ReadProcessMemory(process_handle, ptr, buf, sizeof(buf),
                    &read_bytes) == FALSE || read_bytes != sizeof(buf)) {
                printf("[-] Unable to read a full page?!");
            }

            WriteFile(file_handle, buf, sizeof(buf), &written_bytes, NULL);
        }
    }

    CloseHandle(process_handle);
    CloseHandle(file_handle);
    return 0;
}

int main(){
    int pid;
    scanf("%d",&pid);
    const wchar_t *file_name = "uuu.dmp";
    uintptr_t start_addr = 0x40000;
    uint32_t length = 0x200;
    dump(pid, file_name, start_addr, length);
    return 0;
}