Skip to content

Instantly share code, notes, and snippets.

@ek0
Created February 28, 2020 23:28
Show Gist options
  • Save ek0/ceee915506fd2c19c1f91c74deee722b to your computer and use it in GitHub Desktop.
Save ek0/ceee915506fd2c19c1f91c74deee722b to your computer and use it in GitHub Desktop.
void DumpPages(void* address)
{
MEMORY_BASIC_INFORMATION mem_info;
FILE* desc = nullptr;
FILE* bin = nullptr;
char module_name[MAX_PATH] = { 0 };
char desc_filename_buffer[MAX_PATH] = { 0 };
char bin_filename_buffer[MAX_PATH] = { 0 };
char buffer[0x1000] = { 0 };
snprintf(desc_filename_buffer, MAX_PATH, "desc_%#016" PRIx64 ".txt", address);
snprintf(bin_filename_buffer, MAX_PATH, "bin_%016" PRIx64 ".txt", address);
fopen_s(&desc, desc_filename_buffer, "w");
fopen_s(&bin, bin_filename_buffer, "wb");
// Getting information on the page region.
VirtualQuery(address, &mem_info, sizeof(MEMORY_BASIC_INFORMATION)); // fuck errors
snprintf(buffer, 0x1000, "Base Address of process: %p\nAddress: %p\nPage address: %p\nAllocBase: %p\nRegion size: %#llx\nProtection: %x\nAlloc Protect: %x\n",
GetModuleHandle(NULL),
address,
mem_info.BaseAddress,
mem_info.AllocationBase,
mem_info.RegionSize,
mem_info.Protect,
mem_info.AllocationProtect);
fwrite(buffer, strlen(buffer), 1, desc);
fwrite(mem_info.AllocationBase, mem_info.RegionSize, 1, bin);
fclose(desc);
fclose(bin);
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment