Ну вот пример. Скидывает в файл дамп памяти процесса.
В примере скидываю дамп текущего процесса. Но можно любого, зная его ID.
| Код | program Project1;
uses
Windows, Messages, Classes;
procedure DumpMemory(ProcessID: dword);
var
hProcess: THandle;
Mbi: TMemoryBasicInformation;
Buf: PByte;
adr, r: dword;
fs: TFileStream;
begin
adr := 0; r := 0;
hProcess := OpenProcess(PROCESS_QUERY_INFORMATION or PROCESS_VM_READ or
PROCESS_VM_OPERATION, false, ProcessID);
if hProcess <> 0 then
begin
try
fs := TFileStream.Create('C:\dump.mmr', fmCreate);
except fs := nil; end;
while VirtualQueryEx(hProcess, pointer(Adr), Mbi, SizeOf(Mbi)) <> 0 do
begin
if (Mbi.State = MEM_COMMIT) and not ((Mbi.Protect and PAGE_GUARD) = PAGE_GUARD) then
begin
GetMem(Buf, Mbi.RegionSize);
try
if ReadProcessMemory(hProcess, Mbi.BaseAddress, Buf, Mbi.RegionSize, r) then
if fs <> nil then fs.Write(Buf^, r);
finally
FreeMem(Buf);
end;
end;
adr := adr + Mbi.RegionSize;
end;
fs.Free; CloseHandle(hProcess);
end;
end;
begin
DumpMemory(GetCurrentProcessId);
end. |
|
)