Hi
How give full memory dump from "services.exe" process on windows?
thanks
How give full memory dump from "services.exe" process on windows?
thanks
A forum for reverse engineering, OS internals and malware analysis
Full memory dump or mini dump file format, like Task Manager "Create Dump File" when selecting the process?
Accept nothing less than STATUS_SUCCESS
Access denied on windows 8.1 x64 !!!
running cmd as admin by result is access denied.
running cmd as admin by result is access denied.
That's because services.exe is considered a protected process on Windows 8.1 - Usermode processes will fail to acquire the needed handle access rights to the process. You can use NtSystemDebugControl() from usermode, IIRC it was brought back to life with some information classes on Windows 8/8.1, or simply do this from a driver.
Accept nothing less than STATUS_SUCCESS