CODEWITHSUNDEEP
c++windowsvmwarevirtual-machine
Listing
Listing

Reputation: 1201

Reading and interpreting memory page file in C++

I need to analyse some malware that I have on a vmware image (vmware is a virtual machine), in particular I need to do a full dump of a certain process. I know that vmware,on pausing, writes the whole RAM into a .vmem file. The platform the image is taken of is Windows XP. I know that there are certain tools that do this but they are mostly closed source or don't work for Windows XP. I need it to be done in reasonable time (under one second if that is possible somehow) and to run it from my own C++ program, any help would be really appreciated.

Upvotes: 3

Views: 1304

Answers (1)

Tra5is
Tra5is

Reputation: 146

You seem to be asking to interact with processes and their memory from a suspended VM.

Give some forensic tools a shot. This one looks promising:

http://code.google.com/p/volatility/

Upvotes: 2

Related Questions