Reading process address space

This is a discussion on Reading process address space within the Windows Programming forums, part of the Platform Specific Boards category; hello, I'm working with windows 7, my reaserch is about process migration, I want to access the process's code and ...

  1. #1
    Registered User
    Join Date
    Jan 2012
    Posts
    4

    Reading process address space

    hello,

    I'm working with windows 7, my reaserch is about process migration, I want to access the process's code and data segments, so I tried to get the LDT descriptor, I made a driver to access the EPROCESS struct but when I read the LDTdescriptor I got zero value always, and when I searched for the reason I found that windows NT doesn't use LDT. So, please would you give me any helpful note that might guide me in my work. I don't know how to reach the process's memory space. The process is a specific one and not a system process.

    thanks in advance.

  2. #2
    Captain Crash brewbuck's Avatar
    Join Date
    Mar 2007
    Location
    Portland, OR
    Posts
    7,263
    Call OpenProcess() to get a process handle, then use VirtualQueryEx() to enumerate the page ranges. Use ReadProcessMemory() to get the data.
    Code:
    //try
    //{
    	if (a) do { f( b); } while(1);
    	else   do { f(!b); } while(1);
    //}

  3. #3
    &TH of undefined behavior Fordy's Avatar
    Join Date
    Aug 2001
    Posts
    5,789
    If all you need is the code and data segments then using a driver is overkill.

    brewbuck's methods will do it.

  4. #4
    Registered User
    Join Date
    Jan 2012
    Posts
    4
    Yes all I want is the segments of my process.
    The problem was that I don't know how to get the address, I didn't read about VirtualQueryEx() before.

    I'll try this methods.

    Thank you very much for replying.


Popular pages Recent additions subscribe to a feed

Similar Threads

  1. a library or API providing direct access to a running PE address space
    By renzokuken01 in forum Windows Programming
    Replies: 9
    Last Post: 05-24-2009, 02:40 PM
  2. Process memory space
    By barboris in forum C++ Programming
    Replies: 6
    Last Post: 04-26-2008, 12:35 AM
  3. Replies: 8
    Last Post: 03-31-2008, 11:14 AM
  4. how do you get the min and max address space of a process ,
    By Anddos in forum Windows Programming
    Replies: 3
    Last Post: 06-07-2007, 02:30 AM
  5. Replies: 12
    Last Post: 05-17-2003, 06:58 AM

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21