Hi,
can someone postme a running sample of the
ReadProcessMemo ry(...) function. I would
like to dump the complete memory of the main
module in my application e.g MyApplication.e xe
into a file. Here is a working example of the API
import call:
[DllImport("kern el32.dll", SetLastError = true)]
public static extern bool ReadProcessMemo ry(
IntPtr hProcess,
IntPtr lpBaseAddress,
[Out()] byte[] lpBuffer,
int dwSize,
out int lpNumberOfBytes Read
);
The point is, that i get always a 299 (i know what it means!)
for this call:
Process p = Process.GetCurr entProcess();
string MemoryDumpFileN ame = p.MainModule.Fi leName + ".mem";
byte[] ProcessMemory = new byte[p.MainModule.Mo duleMemorySize];
int NumberOfBytesRe ad = 0;
....
hProcess =
DRWin32APIClass .OpenProcess(DR Win32APIClass.P rocessAccessFla gs.QueryInforma tion
|
DRWin32APIClass .ProcessAccessF lags.VMOperatio n |
DRWin32APIClass .ProcessAccessF lags.VMRead,
false,
(uint) p.Id);
bool _ret = DRWin32APIClass .ReadProcessMem ory(p.Handle,
p.MainModule.Ba seAddress,
ProcessMemory,
p.MainModule.Mo duleMemorySize,
out NumberOfBytesRe ad);
_ret is false (GetLastError=2 99) and lpNumberOfBytes Read is 0, why?
I also enabled any possible privilige in my application including debugging!
Handle to process and ID is valid, confirmed!
Thanks is advance,..
Regards
Kerem
--
-----------------------
Beste Grüsse / Best regards / Votre bien devoue
Kerem Gümrükcü
Latest Project: http://www.codeplex.com/restarts
Latest Open-Source Projects: http://entwicklung.junetz.de
-----------------------
"This reply is provided as is, without warranty express or implied."