I
I
ivan-petrov-19912018-03-21 10:06:24
Programming
ivan-petrov-1991, 2018-03-21 10:06:24

What programs exist for creating memory dumps of running applications?

I know that it is possible to create a complete dump of a running application.
Is it possible to make a dump not entirely, but of individual fragments of memory that the application has allocated for itself?
That is, let's say the program has started, allotted itself 10 fragments of 1 MB each through malloc / calloc.
Here's how to dump the program and 10 fragments into separate files?
Is it something like Sysinternals Process Explorer?
Is it possible to develop such a program for dumps yourself?
For Win9x there was some book about the internals, but for Win7 there isn't.

Answer the question

In order to leave comments, you need to log in

3 answer(s)
J
jcmvbkbc, 2018-03-21
@jcmvbkbc

Here's how to dump the program and 10 fragments into separate files?
Is it possible to develop such a program for dumps yourself?

Keywords: CreateProcess / OpenProcess to create/open an existing process, VirtualQueryEx to view the memory areas allocated by the process and ReadProcessMemory to read data from the desired memory areas.

P
Papa, 2018-03-21
Stifflera @PapaStifflera

Any debugger. For example IDA.

F
freeExec, 2018-03-21
@freeExec

Look for PETools or PEDump .

Didn't find what you were looking for?

Ask your question

Ask a Question

731 491 924 answers to any question