在 Windows 中抓取系统内存以查找与正则表达式匹配的字符串
关于从哪里开始有什么想法吗？
Any ideas on where to start?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
关于从哪里开始有什么想法吗？
Any ideas on where to start?
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
接受 或继续使用网站，即表示您同意使用 Cookies 和您的相关数据。
发布评论
评论（3）
如果您要扫描的进程当前正在运行，那么您可以将其作为调试器连接并抓取其地址空间。
如果您想一般地刮擦内存，则需要安装驱动程序或类似的东西，以便摆脱用户空间。
If the process you want to scan is currently running, then you can connect to it as a debugger and scrape its address space.
If you want to scrape memory in general, you'd need to install a driver or something similar, in order to get out of userspace.
SoftICE (wiki) 可能仍然是 Windows 上最好的调试器。它具有您正在寻找的低级功能，并且可以暂停 Windows 中的所有操作，这对于查看内存变化非常有用。虽然它已经停产，并且现在有很多反 SoftICE 措施（主要是为了保护商业软件），但也有一些隐秘的选项可以使用：IceStealth 或 IceExt。你真的必须自己找出这些软件的源代码，这可能需要一些工作。或者还有其他调试器： Sysersoft 声称已经接手了 SoftICE 停止的地方（尽管我还没有玩过）与它），以及一个开源替代品，Rasta Ring 0 Debugger，此后一直没有开发2006年。
SoftICE (wiki) is still probably the best debugger for Windows. It has the low level capabilities you are looking for and can suspend all operations in Windows which is very useful to look at memory changes. Although it has been discontinued and there are many anti-SoftICE measures about these days (mainly to protect commercial software), there are also some stealthy options to use on top of it: IceStealth or IceExt. You're really gonna have to suss out sources for these bits of software yourself, might be a bit of work. Alternatively there are other debuggers: Sysersoft claims to have taken up where SoftICE left off (although I haven't played with it), and an Open Source alternative, Rasta Ring 0 Debugger which hasn't seen development since 2006.
这是一个非常有趣的概念，尽管它听起来确实很险恶，是一个 root-kit...对于初学者来说，您需要将程序权限提升到管理员权限，并以某种方式开发某种驱动程序（可能是块模式驱动程序）并从用户态对驱动程序进行轮询调用以传递数据块（因此称为块模式驱动程序）。将块的长度作为参数传递给驱动程序（我想），然后用户态代码将检索数据并扫描数据块。
问题在于，由于驱动程序必须驻留在ring0内核模式才能获取内存块，因此您最终会生成 BSOD 和大量调试问题。根据我的喜好，这听起来有点受虐狂的感觉，但话又说回来，您可以使用 VirtualBox 并将 Windows 安装到虚拟机中。
您需要四处寻找 Windows 内核模式驱动程序 SDK，它将使您能够编写驱动程序。除此之外，我不知道如何！ :)
这是我要坚持的我最喜欢的问题。
祝你好运，希望这有帮助，
此致，
汤姆.
That's a very interesting concept albeit it does sound sinister, a root-kit...For starters, you'd need to elevate your program privileges to that of Administrator, and somehow develop some kind of driver (probably a block-mode driver) and from the user-land, make a polling call to the driver to pass out a block of data (hence block-mode driver). The length of the block passed in to the driver (I'd imagine) as a parameter, the user-land code would then retrieve the data and scan the block of data.
The snag is that as the driver would have to reside at ring0 kernel mode in order to fetch the block of memory, you will end up with generating BSOD's and plenty of debugging grief. Sounds way to masochist for my liking, but then again you could use VirtualBox and install Windows into the VM.
You would need to root around looking for Windows Kernel Mode Driver SDK which will enable you to write drivers. Other than that, I wouldn't know how! :)
This is something I am going to stick on my favourite questions.
Good luck and hope this helps,
Best regards,
Tom.