Thread: Reading process address space

  1. #1
    Registered User
    Join Date
    Jan 2012

    Reading process address space


    I'm working with windows 7, my reaserch is about process migration, I want to access the process's code and data segments, so I tried to get the LDT descriptor, I made a driver to access the EPROCESS struct but when I read the LDTdescriptor I got zero value always, and when I searched for the reason I found that windows NT doesn't use LDT. So, please would you give me any helpful note that might guide me in my work. I don't know how to reach the process's memory space. The process is a specific one and not a system process.

    thanks in advance.

  2. #2
    Officially An Architect brewbuck's Avatar
    Join Date
    Mar 2007
    Portland, OR
    Call OpenProcess() to get a process handle, then use VirtualQueryEx() to enumerate the page ranges. Use ReadProcessMemory() to get the data.
    	if (a) do { f( b); } while(1);
    	else   do { f(!b); } while(1);

  3. #3
    &TH of undefined behavior Fordy's Avatar
    Join Date
    Aug 2001
    If all you need is the code and data segments then using a driver is overkill.

    brewbuck's methods will do it.

  4. #4
    Registered User
    Join Date
    Jan 2012
    Yes all I want is the segments of my process.
    The problem was that I don't know how to get the address, I didn't read about VirtualQueryEx() before.

    I'll try this methods.

    Thank you very much for replying.

Popular pages Recent additions subscribe to a feed

Similar Threads

  1. a library or API providing direct access to a running PE address space
    By renzokuken01 in forum Windows Programming
    Replies: 9
    Last Post: 05-24-2009, 01:40 PM
  2. Process memory space
    By barboris in forum C++ Programming
    Replies: 6
    Last Post: 04-25-2008, 11:35 PM
  3. Replies: 8
    Last Post: 03-31-2008, 10:14 AM
  4. how do you get the min and max address space of a process ,
    By Anddos in forum Windows Programming
    Replies: 3
    Last Post: 06-07-2007, 01:30 AM
  5. Replies: 12
    Last Post: 05-17-2003, 05:58 AM