Use OpenProcess() to get a handle to the process that you want to monitor.Then use CreateToolhelp32Snapshot() API which will give you lists of the modules (DLLs) that are a part of your process image which you can then iterate using Module32First/Module32Next() and obtain the load addresses and extents. It will also give you a list of the heaps, runtime allocated memory used by alloc/free and stacks. You then use Heap32ListFirst/Heap32ListNext to iterate those and obtain their start addresses and extents. You then use those addresses with ReadProcessMemory() to actually read the Random Access Memory. Also, be sure to suspend the target process otherwise things could change the moment after you obtain your information. Regards, Rane
