Home/ Questions/Q 7521475
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-30T02:14:25+00:00

Say I have app TestApp.exe While TestApp.exe is running I want a separate program

  • 0

Say I have app TestApp.exe
While TestApp.exe is running I want a separate program to be able to read the executable code that is resident in memory. I’d like to ignore stack and heap and anything else that is tangential.

Put another way, I guess I’m asking how to determine where the memory-side equivalent of the .exe binary data on disk resides. I realize it’s not a 1:1 stuffing into memory.

Edit: I think what I’m asking for is shown as Image in the following screenshot of vmmap.exe
http://i.imgur.com/bARgC.png

Edit: I am able to get from memory all memory that is tagged with any protect flag of Execute* (PAGE_EXECUTE, etc) using VirtualQueryEx and ReadProcessMemory. There are a couple issues with that. First, I’m grabbing about 2 megabytes of data for notepad.exe which is a 189 kilobyte file on disk. Everything I’m grabbing has a protect flag of PAGE_EXECUTE. Second, If I run it on a different Win7 64bit machine I get the same data, only split in half and in a different order. I could use some expert guidance. 🙂

Edit: Also, not sure why I’m at -1 for this question. If I need to clear anything up please let me know.

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    I learned a ton doing this project. I ended up parsing the PE header and using that information to route me all over. In the end I accomplished what I set out to and I am more knowledgeable as a result.

    • 0