Hi, how can i save some memory area to file bypassing the windows memory protection. For example I would like to see first four mb of my RAM and make a memory image on disk for contents analysis. How can I access certain address of memory which do not belong to my process? Pianoman

Pianoman wrote

Hi, how can i save some memory area to file bypassing the windows memory protection. For example I would like to see first four mb of my RAM and make a memory image on disk for contents analysis. How can I access certain address of memory which do not belong to my process?

There is no way I know of.

Michael.

Hello Pianoman,

Tuesday, April 19, 2005, 6:24:10 PM, you wrote:

P> Hi, how can i save some memory area to file bypassing the windows P> memory protection. For example I would like to see first four mb of P> my RAM and make a memory image on disk for contents analysis. How P> can I access certain address of memory which do not belong to my P> process? Pianoman

Generally speaking you need a kernel-mode device driver to do this. There is a freely available example of such driver for Windows NT, called directnt (ftp://ftp.heise.de/pub/ct/ctsi/directnt.zip).

I guess under Win9x it also can be done from a DOS VM running in protected mode (via DPMI calls), not sure if it will work on WinNT though.