grab file from memory process

Question

Is possible in c# grab file loaded into memory by other process? For example image file or txt file. I've a application that load some of that file in memory. i need dump it to disk. i suppose is hard way, can put me in correct way.

I have edited your title. Please see, "Should questions include “tags” in their titles?", where the consensus is "no, they should not". — John Saunders
– John Saunders, Commented Dec 26, 2012 at 14:46
Are you looking for ReadProcessMemory? (you're going to have to pinvoke it to access it) (edit see also stackoverflow.com/questions/9966515/…) — Brad Christie
– Brad Christie, Commented Dec 26, 2012 at 14:47
Put that way your question is completely out of any context. Please provide more information about why you need to do that. Also explain whether the other process is a managed process or not, how is the file loaded in memory in this process, whether you have administrative privileges on the machine, ... — Darin Dimitrov
– Darin Dimitrov, Commented Dec 26, 2012 at 14:48
You can monitor files and re-read them when they accessed via that process — Saw
– Saw, Commented Dec 26, 2012 at 14:59

Hans Passant · Accepted Answer · 2012-12-26 16:15:28Z

1

This is technically not impossible. Assuming you have sufficient rights, you can peek at the memory of another process with the ReadProcessMemory() winapi function. Pinvoke required.

The problem you'll however run into is that you'll discover that you are trying to find a needle in a haystack. You'll have no clue on what virtual memory to start reading unless you know a lot about the process. You start off with a cool 2 billion possible choices, you can probably whittle it down to a million or so. Throw in complications like a garbage collector that randomly moves stuff around.

Get insight in what the virtual memory of another process looks like with the SysInternals' VMMap utility.

answered Dec 26, 2012 at 16:15

Hans Passant

946k151 gold badges1.8k silver badges2.6k bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

Hans Passant Over a year ago

Yes, it is a tool to get insight in how those millions of bytes are organized.

devilkkw Over a year ago

i've read some comment..if i have understand,i need to know correct base adress and offset,then i need to know size to read and grab it.or not?

Hans Passant Over a year ago

Yes, that's what it takes.

Collectives™ on Stack Overflow

grab file from memory process

1 Answer 1

3 Comments

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

3 Comments

Linked

Related