GetProcessMemory return a process memory dump based on its handle
(pid uint32, handle windows.Handle, verbose bool)
| 104 | |
| 105 | // GetProcessMemory return a process memory dump based on its handle |
| 106 | func GetProcessMemory(pid uint32, handle windows.Handle, verbose bool) (ProcessInformation, []byte, error) { |
| 107 | |
| 108 | procFilename, modules, err := GetProcessModulesHandles(handle) |
| 109 | if err != nil { |
| 110 | return ProcessInformation{}, nil, fmt.Errorf("Unable to get PID %d memory: %s", pid, err.Error()) |
| 111 | } |
| 112 | |
| 113 | for _, moduleHandle := range modules { |
| 114 | if moduleHandle != 0 { |
| 115 | moduleRawName, err := GetModuleFileNameEx(handle, moduleHandle, 512) |
| 116 | if err != nil { |
| 117 | return ProcessInformation{}, nil, err |
| 118 | } |
| 119 | moduleRawName = bytes.Trim(moduleRawName, "\x00") |
| 120 | modulePath := strings.Split(string(moduleRawName), "\\") |
| 121 | moduleFileName := modulePath[len(modulePath)-1] |
| 122 | |
| 123 | if procFilename == moduleFileName { |
| 124 | return ProcessInformation{PID: pid, ProcessName: procFilename, ProcessPath: string(moduleRawName)}, DumpModuleMemory(handle, moduleHandle, verbose), nil |
| 125 | } |
| 126 | } |
| 127 | } |
| 128 | |
| 129 | return ProcessInformation{}, nil, fmt.Errorf("Unable to get PID %d memory: no module corresponding to process name", pid) |
| 130 | } |
| 131 | |
| 132 | // KillProcessByID try to kill the specified PID |
| 133 | func KillProcessByID(procID uint32, verbose bool) (err error) { |
no test coverage detected