DumpModuleMemory dump a process module memory and return it as a byte slice
(procHandle windows.Handle, modHandle syscall.Handle, verbose bool)
| 179 | |
| 180 | // DumpModuleMemory dump a process module memory and return it as a byte slice |
| 181 | func DumpModuleMemory(procHandle windows.Handle, modHandle syscall.Handle, verbose bool) []byte { |
| 182 | moduleInfos, err := GetModuleInformation(procHandle, modHandle) |
| 183 | if err != nil && verbose { |
| 184 | logMessage(LOG_ERROR, "[ERROR]", err) |
| 185 | } |
| 186 | |
| 187 | memdump, err := ReadProcessMemory(procHandle, moduleInfos.BaseOfDll, uintptr(moduleInfos.SizeOfImage)) |
| 188 | if err != nil && verbose { |
| 189 | logMessage(LOG_ERROR, "[ERROR]", err) |
| 190 | } |
| 191 | |
| 192 | memdump = bytes.Trim(memdump, "\x00") |
| 193 | return memdump |
| 194 | } |
| 195 | |
| 196 | // WriteProcessMemoryToFile try to write a byte slice to the specified directory |
| 197 | func WriteProcessMemoryToFile(path string, file string, data []byte) (err error) { |
no test coverage detected