简体繁体 English

用C ++读取和解释内存页面文件

[英]Reading and interpreting memory page file in C++

原文 2011-11-17 23:49:15 7 1 c++/ windows/ vmware/ virtual-machine

I need to analyse some malware that I have on a vmware image (vmware is a virtual machine), in particular I need to do a full dump of a certain process. 我需要分析我在vmware映像上的一些恶意软件（vmware是虚拟机），特别是我需要对某个进程进行完全转储。 I know that vmware,on pausing, writes the whole RAM into a .vmem file. 我知道vmware在暂停时会将整个RAM写入.vmem文件。 The platform the image is taken of is Windows XP. 拍摄图像的平台是Windows XP。 I know that there are certain tools that do this but they are mostly closed source or don't work for Windows XP. 我知道有一些工具可以做到这一点，但它们大多是封闭源或不适用于Windows XP。 I need it to be done in reasonable time (under one second if that is possible somehow) and to run it from my own C++ program, any help would be really appreciated. 我需要在合理的时间内完成（如果可能的话，在一秒钟内完成）并从我自己的C ++程序运行它，任何帮助都会非常感激。

1 个解决方案

You seem to be asking to interact with processes and their memory from a suspended VM. 您似乎要求从已挂起的VM与进程及其内存进行交互。

Give some forensic tools a shot. 给一些法医工具一枪。 This one looks promising: 这看起来很有希望：

http://code.google.com/p/volatility/ http://code.google.com/p/volatility/

C ++内存泄漏-解释分析 - C++ Memory Leak - interpreting analysis

C ++可能的内存泄漏读取文件 - C++ possible memory leak reading file

用C ++将大文本文件读取到内存 - Reading a large text file to memory in C++

缓慢的文件读取和复制到内存-C ++ - Slow file reading and copying into memory - C++

C ++ Visual Studio-解释简单示例中的内存泄漏检测 - C++ Visual Studio - Interpreting memory leak detection on simple example

C ++在内存中使用缓冲区而不是直接读取文件 - c++ use a buffer in memory instead reading directly a file

写入/读取 Memory Stream 中的内容，而不是 Stream 中的 Stream - Writing/Reading the contents in a Memory Stream instead of File Stream in C++

读取二进制文件而不用C ++将整个文件缓冲到内存中 - Reading binary files without buffering the whole file into memory in C++

C ++：从内存映射文件读取/获取数据 - C++: Reading / getting data from a memory mapped file

C ++：从内存映射文件读取数据 - C++: Reading data from a memory mapped file

暂无

暂无

声明:本站的技术帖子网页，遵循CC BY-SA 4.0协议，如果您需要转载，请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.

相关问题 C ++内存泄漏-解释分析 - C++ Memory Leak - interpreting analysis C ++可能的内存泄漏读取文件 - C++ possible memory leak reading file 用C ++将大文本文件读取到内存 - Reading a large text file to memory in C++ 缓慢的文件读取和复制到内存-C ++ - Slow file reading and copying into memory - C++ C ++ Visual Studio-解释简单示例中的内存泄漏检测 - C++ Visual Studio - Interpreting memory leak detection on simple example C ++在内存中使用缓冲区而不是直接读取文件 - c++ use a buffer in memory instead reading directly a file 写入/读取 Memory Stream 中的内容，而不是 Stream 中的 Stream - Writing/Reading the contents in a Memory Stream instead of File Stream in C++ 读取二进制文件而不用C ++将整个文件缓冲到内存中 - Reading binary files without buffering the whole file into memory in C++ C ++：从内存映射文件读取/获取数据 - C++: Reading / getting data from a memory mapped file C ++：从内存映射文件读取数据 - C++: Reading data from a memory mapped file

相关标签

粤ICP备18138465号 © 2020-2024 STACKOOM.COM