Solution Needed Please
-
I'm currently on a project which needs to exam memory contents of an other process, basically, it searchs for certain pattern in the target process's page memorys, if pattern found then do some further examination, else keeps searching for same pattern. I did it by this way: First, I use
::VirtualQueryExto obtain all pages of the target process and store those page information(base address and page size) in an array. This step completes in no time. Second, I use::ReadProcessMemoryto read the memory from each page(bytes by bytes) and compare the bytes with my predefined pattern, which are an array of bytes, usingmemcmp. I will finally find the memory address that I want for sure, but the problem is that it's slow, very slow. The target process has over 500 pages and total size of which are over 70MB, it takes like 50 seconds to finish the searching, and that makes my application completely useless. Now since you guys are all gurus out here, I think there must be something to do to shorten the search time, please help and thanks in advance. -
I'm currently on a project which needs to exam memory contents of an other process, basically, it searchs for certain pattern in the target process's page memorys, if pattern found then do some further examination, else keeps searching for same pattern. I did it by this way: First, I use
::VirtualQueryExto obtain all pages of the target process and store those page information(base address and page size) in an array. This step completes in no time. Second, I use::ReadProcessMemoryto read the memory from each page(bytes by bytes) and compare the bytes with my predefined pattern, which are an array of bytes, usingmemcmp. I will finally find the memory address that I want for sure, but the problem is that it's slow, very slow. The target process has over 500 pages and total size of which are over 70MB, it takes like 50 seconds to finish the searching, and that makes my application completely useless. Now since you guys are all gurus out here, I think there must be something to do to shorten the search time, please help and thanks in advance.the only thing i can think of, is writing some own memcmp function based on KnuthMorrisPrat or BoyreMoore algorithms... I actualy dont know how the standard memcmp behaves but I imagine it has a O(nm) runtime, so if your pattern is relativly long, you can speedup your app a lot. (I GUESS)
-
I'm currently on a project which needs to exam memory contents of an other process, basically, it searchs for certain pattern in the target process's page memorys, if pattern found then do some further examination, else keeps searching for same pattern. I did it by this way: First, I use
::VirtualQueryExto obtain all pages of the target process and store those page information(base address and page size) in an array. This step completes in no time. Second, I use::ReadProcessMemoryto read the memory from each page(bytes by bytes) and compare the bytes with my predefined pattern, which are an array of bytes, usingmemcmp. I will finally find the memory address that I want for sure, but the problem is that it's slow, very slow. The target process has over 500 pages and total size of which are over 70MB, it takes like 50 seconds to finish the searching, and that makes my application completely useless. Now since you guys are all gurus out here, I think there must be something to do to shorten the search time, please help and thanks in advance.=[ Abin ]= wrote: it takes like 50 seconds to finish the searching, and that makes my application completely useless. If by "useless" you mean nonresponsive, then I suggest you put the processing code in a separate thread. That way, your UI remains responsive. See this article for more.
"When I was born I was so surprised that I didn't talk for a year and a half." - Gracie Allen