关于转储 ram 方法的问题 [所有语言和平台]
我最近决定编写一个应用程序，作为市场上某些闭源内存转储应用程序的开源替代品；主要作为一种学习经历。
但我不完全确定从哪里开始（对于 Windows 机器）。我想我必须使用在内核级别执行的例程来迭代内存，但是如何在拍摄快照时阻止机器执行任何操作，或者尽可能少地执行操作，甚至可以访问像那样的公羊，我迷路了。
任何有经验或建议的人都会受到赞赏，这是非常有趣的话题。
I recently decided that I'd like to write an application that would be an open source alternative to some of the closed source ram dump applications on the market; primarily as a learning experience.
But I'm not entirely sure where to start (for Windows machines). I guess that I'd have to iterate through memory using a routine that was executed at the kernel level, but how I'd stop the machine from doing anything while taking a snapshot, or doing as little as possible, or even having access to the ram like that, I'm lost.
Anyone with experience or advice is appreciated, very interesting topic.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
对于 Windows，您需要的一切都在 dbghelp.dll 中 - 参考 这里。
您可以直接调用 Minidump 函数，也可以手动遍历所有结构（这需要更多工作，但更符合您描述的教育练习）。
对于过程控制，有关编写基本调试器的信息 应该有用。
For Windows everything you need is in dbghelp.dll - reference here.
You can either call the Minidump functions directly, or walk all the structures by hand (which is a lot more work but more in line with the educational exercise you describe).
For process control, the info on writing a basic debugger should be useful.
Google Breakpad 可能会有所帮助。不过我自己还没用过
There is Google Breakpad which might help out. Haven't used it myself yet, though,
这是一个关于暂停进程以便您可以使用它的快速教程。
http://www.infernodevelopment.com/freeze-programs-using-win32-threads
这里有一些函数对于查找你想要查看的进程或窗口很有用
用于读取内存，你可以使用以下 api 函数。
谷歌搜索这些应该会给你一个好的开始
here is a quick tutorial on pausing a process so you can play with it.
http://www.infernodevelopment.com/freeze-programs-using-win32-threads
here are some functions useful for finding the process or window you want to look at
for reading the memory, you can use the following api functions.
a google search of those should give you a good start