CODEWITHSUNDEEP
.netc#-4.0memory
kuhajeyan
kuhajeyan

Reputation: 11037

how to get full memory dump of RAM using c#

How to get Complete Memory Dump using C#.NET?

Upvotes: 3

Views: 2587

Answers (2)

Sedat Kapanoglu
Sedat Kapanoglu

Reputation: 47680

The only safe way to do it is to cause a bluescreen and have Windows get the dump itself. Causing a bluescreen happens through KeBugCheckEx kernel function and you need a custom-built device driver to call it programmatically. Or you can use CrashOnCtrlScroll registry trick and trigger it yourself.

Or you can connect a kernel debugger to the system using two computers and trigger a memory dump using .crash debugger command.

There are methods like LiveKD from SysInternals to do partial kernel inspection on the same computer but they are not "accurate" because memory changes continuously. It's impossible to get a healthy dump using those methods.

Doing all these using C# is, pointless.

Upvotes: 3

msam
msam

Reputation: 4287

With MiniDumpWriteDump you can get a full process dump by specifying DumpType as MiniDumpWithFullMemory.

You might try to get this for all processes in the system by getting a list of process handles and iterating over that with MiniDumpWriteDump. I do not know if you will have security related issues.

As for getting a kernel memory dump from a user mode process, as far as I know, this should not be possible.

Upvotes: 0

Related Questions