IDA保存内存快照

双刃剑客

于 2018-10-25 15:10:53 发布

阅读量2k

点赞数

CC 4.0 BY-SA版权

分类专栏：工作经验

本文链接：https://blog.youkuaiyun.com/zhangmiaoping23/article/details/83379664

转：https://www.hex-rays.com/products/ida/support/idadoc/1470.shtml

Take memory snapshot

 Action    name: TakeSnapshot

This command copies the contents of the process memory to the database. It is available during a debugging session.

The memory contents will be copied to the database. The user may specify that only the segments with the 'loader' attribute will be saved in the database.

The segments with the loader attribute are created by the input file loader and usually contain information from the input file. However, in some cases (like attaching to an existing process), there will not be any loader segments because the input file was not loaded by IDA.

To be able to make a partial snapshot in this case and other similar cases, the user can set or clear the 'lo