Question

I need to analyse some malware that I have on a vmware image (vmware is a virtual machine), in particular I need to do a full dump of a certain process. I know that vmware,on pausing, writes the whole RAM into a .vmem file. The platform the image is taken of is Windows XP. I know that there are certain tools that do this but they are mostly closed source or don’t work for Windows XP. I need it to be done in reasonable time (under one second if that is possible somehow) and to run it from my own C++ program, any help would be really appreciated.

Answer 1

You seem to be asking to interact with processes and their memory from a suspended VM.

Give some forensic tools a shot. This one looks promising:

http://code.google.com/p/volatility/