我正在寻找一个可执行文件，它在运行时会将记事本转储到我驱动器上某处的文本文档中。这很重要，因为我希望能够扫描文件中的关键字并在找到它们时提醒最终用户。
这是我目前拥有的代码：
Private Const ProcessQueryInformation As Integer = &H400
Private Const ProcessVmRead As Integer = &H10
<DllImport("dbghelp", CallingConvention:=CallingConvention.Winapi, SetLastError:=True)>
Private Shared Function MiniDumpWriteDump(
ByVal hProcess As SafeFileHandle,
ByVal processId As Int32,
ByVal hFile As SafeFileHandle,
ByVal dumpType As MinidumpType,
ByVal exceptionParam As IntPtr,
ByVal userStreamParam As IntPtr,
ByVal callbackParam As IntPtr) As <MarshalAs(UnmanagedType.Bool)> Boolean
End Function
<DllImport("kernel32", CallingConvention:=CallingConvention.Winapi, SetLastError:=True)>
Public Shared Function OpenProcess(
ByVal dwDesiredAccess As UInteger,
ByVal bInheritHandle As Boolean,
ByVal dwProcessId As Integer) As SafeFileHandle
End Function
<Flags()>
Private Enum MinidumpType
MiniDumpNormal = 0
MiniDumpWithDataSegs = 1
MiniDumpWithFullMemory = 2
MiniDumpWithHandleData = 4
MiniDumpFilterMemory = 8
MiniDumpScanMemory = &H10
MiniDumpWithUnloadedModules = &H20
MiniDumpWithIndirectlyReferencedMemory = &H40
MiniDumpFilterModulePaths = &H80
MiniDumpWithProcessThreadData = &H100
MiniDumpWithPrivateReadWriteMemory = &H200
MiniDumpWithoutOptionalData = &H400
MiniDumpWithFullMemoryInfo = &H800
MiniDumpWithThreadInfo = &H1000
MiniDumpWithCodeSegs = &H2000
MiniDumpWithoutAuxiliaryState = &H4000
MiniDumpWithFullAuxiliaryState = &H8000
End Enum
Private Sub Button1_Click(ByVal sender As Object, ByVal e As System.EventArgs) Handles Button1.Click
' Get the process id.
Dim id As Integer = GetProcessId("notepad")
' Get the process handle from the id.
Dim hProcess As SafeFileHandle = Nothing ' We could define a SafeProcessHandle...
Try
hProcess = OpenProcess(ProcessVmRead Or ProcessQueryInformation, False, id)
' Check result...
If hProcess Is Nothing Then
If Marshal.GetLastWin32Error = 0 Then
Throw New Win32Exception
End If
End If
Dim oneFileName As String = "C:\dump.txt"
Using oneFile As FileStream = New FileStream(oneFileName, FileMode.Create)
MiniDumpWriteDump(hProcess, id, oneFile.SafeFileHandle, MinidumpType.MiniDumpWithFullMemory,
Nothing, Nothing, Nothing)
oneFile.Flush()
End Using
Finally
If hProcess IsNot Nothing Then
hProcess.Close()
hProcess.Dispose()
End If
End Try
End Sub
Private Function GetProcessId(ByVal processName As String) As Integer
Dim id As Integer = -1
Dim processes() As Process = Process.GetProcessesByName(processName)
If processes.Count = 0 Then Throw New ArgumentException("Could not find the process specified", "processName")
id = processes(0).Id ' There could be many processes - we just grab the first.
For Each p As Process In processes
p.Dispose()
Next
Return id
End Function
我的问题是，每当我运行此代码时，我都会得到一个空白文本文档。我知道函数 MiniDumpWriteDump 返回 false，我只是不知道为什么——这就是我在这里的原因。
供您参考，这发生在每个过程中，但它本身。