Create Process and Dump its Memory to String

I have executed a process using CreateProcess, but I want to dump the memory area allocated to the process how to do that?

my code so far is:

function ExecuteAndDumpProcess(FileName: String): String;
var
  BytesRead : DWORD;
  BufferSize : Integer;
begin
  flag:=0;
  idh := pointer(LoadLibraryEx(PChar(FileName),0,DONT_RESOLVE_DLL_REFERENCES));
  inh := pointer(dword(idh)+idh^._lfanew);
  EP :=  pointer(inh^.OptionalHeader.ImageBase + inh^.OptionalHeader.AddressOfEntryPoint);
  GetStartupInfo(si);
     if CreateProcess(pChar(FileName),nil,nil,nil,FALSE,DEBUG_PROCESS+DEBUG_ONLY_THIS_PROCESS,nil,nil,si,pi) then
     While TRUE do begin
       WaitForDebugEvent(DBEvent, 100000);

       if DBEvent.dwDebugEventCode = EXIT_PROCESS_DEBUG_EVENT then
       Begin
         Exit;
       End;

       if dbevent.dwDebugEventCode = CR开发者_Python百科EATE_PROCESS_DEBUG_EVENT then
       Begin
       End;

       If dbevent.dwDebugEventCode = EXCEPTION_DEBUG_EVENT then
       Begin
//         if (DBEvent.Exception.ExceptionRecord.ExceptionCode = EXCEPTION_BREAKPOINT) and (flag = 1) then
         Begin
           BufferSize:= (1024 * 1024) * 4;
           SetLength(Result, BufferSize);
           ReadProcessMemory(pi.hProcess, Pointer(dword(EP)-15), @Result[0], BufferSize, BytesRead);
           FreeLibrary(dword(idh));
           CloseHandle(pi.hProcess);
           CloseHandle(pi.hThread);
           //ContinueDebugEvent(DBEvent.dwProcessId,DBEvent.dwThreadId,DBG_TERMINATE_THREAD);
          // ContinueDebugEvent(DBEvent.dwProcessId,DBEvent.dwThreadId,DBG_TERMINATE_PROCESS);
          // ContinueDebugEvent(DBEvent.dwProcessId,DBEvent.dwThreadId,DBG_CONTROL_BREAK);
           TerminateProcess(pi.hProcess, 0);
           Exit;
         End;
         if (DBEvent.Exception.ExceptionRecord.ExceptionCode = EXCEPTION_BREAKPOINT) and (flag=0) then
         begin
           inc(flag);
         end;
         ContinueDebugEvent(DBEvent.dwProcessId,DBEvent.dwThreadId,DBG_CONTINUE);
       end;
       ContinueDebugEvent(DBEvent.dwProcessId,DBEvent.dwThreadId,DBG_EXCEPTION_NOT_HANDLED);
    end;
end;

---

I think you're trying to read 4 Mb of memory in a single read operation. You should have a loop instead that reads one memory page at a time (tipically 4 Kb, not 4 Mb as in your code). You can get the proper number from the GetSystemInfo API call: http://msdn.microsoft.com/en-us/library/windows/desktop/ms724381(v=vs.85).aspx

You also have to expect some addresses to be unmapped in the debugged process. ReadProcessMemory will return with error if you try to read from a memory address that's not being used.