format pe gui 4.0
entry start
include 'win32ax.inc'

struct  MEMORY_BASIC_INFORMATION
        BaseAddress          dd ?
        AllocationBase       dd ?
        AllocationProtect    dd ?
        RegionSize           dd ?
        State                dd ?
        Protect              dd ?
        Type                 dd ?
ends

mbi MEMORY_BASIC_INFORMATION

proc start
invoke _lcreat, SzFile, 0
mov [hfile], eax
invoke OpenProcess,PROCESS_ALL_ACCESS, FALSE,[PID]
mov [hProc],eax
mov [shagMemory],0
gogogo:
invoke VirtualQueryEx, [hProc], [shagMemory], mbi,sizeof.MEMORY_BASIC_INFORMATION
or eax,eax
jz stopeee
invoke ReadProcessMemory,[hProc],[mbi.BaseAddress],bufer,[mbi.RegionSize],BytesRead

;invoke wsprintf,temp,formats,mbi.RegionSize
;invoke wsprintf,temps,formats,BytesRead
;invoke MessageBox,NULL,temp,temps,NULL

invoke _lwrite, [hfile],bufer,BytesRead

mov eax,[mbi.RegionSize]
add [shagMemory],eax
jmp gogogo
stopeee:
invoke CloseHandle, [hfile]
invoke CloseHandle, [hProc]
invoke MessageBox,NULL,'ExitProcess','End',NULL
invoke ExitProcess,0

endp


;/////////////////////////////////////////////////////////////
PID   dd 2844
hProc dd ?
shagMemory dd ?
SzFile db 'G:\test.txt',0
hfile dd ?
BytesRead dd ?
formats db "%d",0
temp db 256 dup(?)
temps db 256 dup(?)
bufer dd ?
len_buf = $ - bufer



;/////////////////////////////////////////////////////////////

data import
library kernel32, 'KERNEL32.DLL',\
        user32,   'USER32.DLL'
import kernel32,\
GetLastError,'GetLastError',\
       ExitProcess, 'ExitProcess',\
       OpenProcess, 'OpenProcess',\
       GlobalAlloc, 'GlobalAlloc',\
       ReadProcessMemory, 'ReadProcessMemory',\
       CloseHandle, 'CloseHandle',\
       VirtualQueryEx, 'VirtualQueryEx',\
       _lcreat,'_lcreat',\
       _lwrite,'_lwrite',\
       Sleep,'Sleep'
import user32,\
       MessageBox, 'MessageBoxA',\
       wsprintf, 'wvsprintfA'
end data
    

Address = NULL;

while (VirtualQueryEx (... Address, ...) == sizeof.MEMORY_BASIC_INFORMATION)
{
        if (bmi.State has bit MEM_COMMIT)
        {
                if (RegionSize > allocated for buffer)
                {
                        ReAllocate buffer ...
                }
                ReadProcessMemory (... Address, ... RegionSize);
                _lwrite (...);
        }

        Address += RegionSize;
}