0

I have executed a process using CreateProcess, but I want to dump the memory area allocated to the process how to do that?

my code so far is:

function ExecuteAndDumpProcess(FileName: String): String;
var
  BytesRead : DWORD;
  BufferSize : Integer;
begin
  flag:=0;
  idh := pointer(LoadLibraryEx(PChar(FileName),0,DONT_RESOLVE_DLL_REFERENCES));
  inh := pointer(dword(idh)+idh^._lfanew);
  EP :=  pointer(inh^.OptionalHeader.ImageBase + inh^.OptionalHeader.AddressOfEntryPoint);
  GetStartupInfo(si);
     if CreateProcess(pChar(FileName),nil,nil,nil,FALSE,DEBUG_PROCESS+DEBUG_ONLY_THIS_PROCESS,nil,nil,si,pi) then
     While TRUE do begin
       WaitForDebugEvent(DBEvent, 100000);

       if DBEvent.dwDebugEventCode = EXIT_PROCESS_DEBUG_EVENT then
       Begin
         Exit;
       End;

       if dbevent.dwDebugEventCode = CREATE_PROCESS_DEBUG_EVENT then
       Begin
       End;

       If dbevent.dwDebugEventCode = EXCEPTION_DEBUG_EVENT then
       Begin
//         if (DBEvent.Exception.ExceptionRecord.ExceptionCode = EXCEPTION_BREAKPOINT) and (flag = 1) then
         Begin
           BufferSize:= (1024 * 1024) * 4;
           SetLength(Result, BufferSize);
           ReadProcessMemory(pi.hProcess, Pointer(dword(EP)-15), @Result[0], BufferSize, BytesRead);
           FreeLibrary(dword(idh));
           CloseHandle(pi.hProcess);
           CloseHandle(pi.hThread);
           //ContinueDebugEvent(DBEvent.dwProcessId,DBEvent.dwThreadId,DBG_TERMINATE_THREAD);
          // ContinueDebugEvent(DBEvent.dwProcessId,DBEvent.dwThreadId,DBG_TERMINATE_PROCESS);
          // ContinueDebugEvent(DBEvent.dwProcessId,DBEvent.dwThreadId,DBG_CONTROL_BREAK);
           TerminateProcess(pi.hProcess, 0);
           Exit;
         End;
         if (DBEvent.Exception.ExceptionRecord.ExceptionCode = EXCEPTION_BREAKPOINT) and (flag=0) then
         begin
           inc(flag);
         end;
         ContinueDebugEvent(DBEvent.dwProcessId,DBEvent.dwThreadId,DBG_CONTINUE);
       end;
       ContinueDebugEvent(DBEvent.dwProcessId,DBEvent.dwThreadId,DBG_EXCEPTION_NOT_HANDLED);
    end;
end;

1 Answer 1

0

I think you're trying to read 4 Mb of memory in a single read operation. You should have a loop instead that reads one memory page at a time (tipically 4 Kb, not 4 Mb as in your code). You can get the proper number from the GetSystemInfo API call: http://msdn.microsoft.com/en-us/library/windows/desktop/ms724381(v=vs.85).aspx

You also have to expect some addresses to be unmapped in the debugged process. ReadProcessMemory will return with error if you try to read from a memory address that's not being used.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.