Mapping memory of another process
in [Win32 Kernel]
|
Prev: GetComputerObjectName() fails when called in auto-start serviceat boot time
Next: Windows 2003 Performance vs. Windows 2000
From: Arno Schoedl on 14 Sep 2006 10:33 Hello, I would like to map a memory section of another process into my own process, which is a regular user-mode process. I know about shared memory with page file mappings, but in this case I am examining another process which is not my own. So far, I am using Read/WriteProcessMemory, which works, but is quite slow and requires additional memory. I would prefer reaching directly into the other process' address space. Any way to do this? TIA, Arno
From: Arkady Frenkel on 14 Sep 2006 10:57 You can do that directly because of protection mode Win32 use for that Arkady "Arno Schoedl" <aschoedl(a)think-cell.com> wrote in message news:1158244427.100619.13090(a)i42g2000cwa.googlegroups.com... > Hello, > > I would like to map a memory section of another process into my own > process, which is a regular user-mode process. I know about shared > memory with page file mappings, but in this case I am examining another > process which is not my own. So far, I am using > Read/WriteProcessMemory, which works, but is quite slow and requires > additional memory. I would prefer reaching directly into the other > process' address space. Any way to do this? > > TIA, > > Arno >
From: Arno Schoedl on 14 Sep 2006 11:03 What do you mean? Arno
From: Arnie on 14 Sep 2006 14:05 "Arno Schoedl" <aschoedl(a)think-cell.com> wrote in message news:1158246230.774415.325910(a)p79g2000cwp.googlegroups.com... > What do you mean? > > Arno > I think Arkady probably meant: You CAN'T do that directly because of protection mode Win32 use for that - Arnie
From: Arno Schoedl on 14 Sep 2006 18:13
Does NtMapViewOfSection help? I saw articles about writing into portions of physical memory. Can I use it to map portions of the virtual addresses of other processes? Arno |