IDA保存内存快照

转：https://www.hex-rays.com/products/ida/support/idadoc/1470.shtml

Take memory snapshot

 Action    name: TakeSnapshot
 

This command copies the contents of the process memory to the database. It is available during a debugging session.

The memory contents will be copied to the database. The user may specify that only the segments with the 'loader' attribute will be saved in the database.

The segments with the loader attribute are created by the input file loader and usually contain information from the input file. However, in some cases (like attaching to an existing process), there will not be any loader segments because the input file was not loaded by IDA.

To be able to make a partial snapshot in this case and other similar cases, the user can set or clear the 'loader' attribute of the desired segments using the edit segment command.

After applying this command, the user can terminate the debugging process and continue to analyze the program in the database.

Please note that it is possible to save the database without taking a memory snapshot. Such a database might be used to keep global information about the program like the breakpoint information, notes, etc. However, we recommend to take a memory snapshot of at least the 'loader' segments because it will allow to save also information about the program functions, names, comments, etc.

See also Debugger submenu.

调试时候步骤：

1.给需要内存快照的segment增加Loader属性。

2.File->script command...，执行TakeMemorySnapshot(1);命令

3. File->Save as->保存文件或File->Take database snapshot...