进程内部/外部生成的不同内存转储
我最近一直在玩内存转储，偶然发现了一些我不完全理解的东西。
如果我有一个进程并使用 VirtualQueryEx & 转储其内存内容ReadProcessMemory 来抓取数据并将其转储到文件中，一切正常。同时，我尝试通过在进程内部执行 VirtualQuery 并仅转储它返回的指针的内容来执行相同的操作。 我能够通过代理我正在测试的进程的 DLL 之一来做到这一点。 现在，问题是这两个内存转储不同（从进程内部创建的转储中缺少区域） 有人可以告诉我为什么会发生这种情况吗？ Windows XP SP3 + Visual Studio 2008 非常感谢。
I have been playing around lately with memory dumping and stumbled upon something that I didn't fully understand.
If I have a process and dump its memory contents by using VirtualQueryEx & ReadProcessMemory to grab the data and dump it to a file everything is ok. Meanwhile, I have tried doing the same thing by being internal to the process and doing VirtualQuery and just dumping the contents of the pointers it returns.
I was able to do this by proxying one of the DLLs of the process I am testing on.
Now, the problem is that these two memory dumps are different ( missing areas from the dump created from inside the process )
Could somebody enlighten me as to why this is happening ?
Windows XP SP3 + Visual Studio 2008
Thank you very much.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
你需要倾倒什么？谈到进程分配的所有内存页面，我认为您可以获得不同的值，因为内部进程状态（通常）每次都是唯一的。另外，如果您将进程的内存转储到进程外部，则转储程序的代码不在转储进程地址空间中，而如果您从进程内部转储进程，则该进程现在包含转储程序的代码。因此，仅转储属于进程应用程序或 DLL 的特定数量的页面可能会很有用。
What do you need to dump? Speaking about all the memory pages that are allocated by the process then I think that you can get different values because of the internal process state that is (in general) unique per time. Also, if you are dumping process's memory outside the process then the dumper's code is not in the dumping process address space while if you are dumping process from inside the process, the process now includes the dumper's code. So, it may be useful to dump only certain number of pages belongs to process application or DLL's.