Click to See Complete Forum and Search --> : Getting process allocated memory cells list


tepez
December 6th, 2006, 11:50 AM
I wrote a simple debugger using the Win32 debug API.
I want to find all the memory allocated by the debugged program and see what's in it using ReadProcessMemory. The memory space is huge so I can't go through all of it. Is there any way to find only the allocated cells' addresses?

Zaccheus
December 7th, 2006, 04:10 AM
I think you need to start by calling GetProcessHeaps and then use HeapWalk.

tepez
December 7th, 2006, 06:56 AM
Yes but that would give me the Heap of the calling process - the debugger.
How can I get the heap of the specific process, the debugee in my case.

Zaccheus
December 7th, 2006, 07:27 AM
Sorry, you are right, GetProcessHeaps only works on the current process.

tepez
December 7th, 2006, 09:17 AM
So how do I get the Heap of the debugee process?

Calculator
December 7th, 2006, 09:47 PM
There could be a better way but some wierd combination of like CreateRemoteThread, having the thread do what Zacc suggested, and then some sort of IPC some way or another (ReadProcessMemory would work)