asked on

Memory

Hello ,

Is it possible to get access to whole (physicly + virtual)
memory under windows using delphi/windows API ?

As i know accessing memory under protected mode possible
only from 0 ring or parent application/driver . But
"memory dump applications" reading memory without additional
VXD drivers.

Ivan

Madshi

Look at winAPI "VirtualProtect(Ex)". Sorry, have neither experience with these functions nor sources.

Regards, Madshi.

rwilson032697

No it isn't, except by using a ring 0 device (VxD) and even then you are in tricky territory. Modern OSes simply cannot allow a process to have unrestricted _access_, even to read memory.

To do so would completely destroy any semblance of security.

Sorry :-(

Raymond.

jecksom

ASKER

Hi , rwilson!

Well , i've already found solution . I can recommend you to look on win32 functions more
closer , which are :
VirtualQueryex
VirtualProtectex
read/writeProcessMemory
createprocesSnopShot ,first/Nextprocess,first/nextheap32,debug functions.
(o'coz some of those functions doesn't have support under NT 4.0 and probably will
be only from 5.0 > , but who could carry about users that using GUI - SERVER OS ?!?,
so it isn't a problem).

Thanx you anyway!
Jecksom

PS : Madshi ! You gave me great idea where to start , so after 2 days digging web pages ,
i've understand how it works !

Madshi

jecksom,

was this one-line-comment helpful enough for 175 points???
If it was, tell me. Then I will post a dummy answer.
If not, just keep the question idle. It will then be automatically deleted in a few weeks.

Regards, Madshi.

jecksom

ASKER

Madshi !

Yep , i guess it 's enough for 175 point ! gimme your dummy answer ! :)

Jecksom

ASKER CERTIFIED SOLUTION

Madshi

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial