b245014abd
Use the (undocumented) MEMORY_WORKING_SET_EX_INFORMATION in dumper to determine if a MEM_IMAGE region is unsharable, and hence has been modified. After this, we will end up dumping memory regions where: - state is MEM_COMMIT (i.e. is not MEM_RESERVE or MEM_FREE), and -- type is MEM_PRIVATE and protection allows reads (i.e. not a guardpage), or -- type is MEM_IMAGE and attribute is non-sharable (i.e. it was WC, got written to, and is now a RW copy) |
||
|---|---|---|
| .. | ||
| COPYING.dumper | ||
| Makefile.in | ||
| aclocal.m4 | ||
| autogen.sh | ||
| bloda.cc | ||
| chattr.c | ||
| configure | ||
| configure.ac | ||
| cygcheck.cc | ||
| cygpath.cc | ||
| cygwin-console-helper.cc | ||
| dump_setup.cc | ||
| dumper.cc | ||
| dumper.h | ||
| gencat.c | ||
| getconf.c | ||
| getfacl.c | ||
| kill.cc | ||
| ldd.cc | ||
| ldh.cc | ||
| loadlib.h | ||
| locale.cc | ||
| lsattr.c | ||
| minidumper.cc | ||
| mkgroup.c | ||
| mkpasswd.c | ||
| module_info.cc | ||
| mount.cc | ||
| passwd.c | ||
| path.cc | ||
| path.h | ||
| pldd.c | ||
| ps.cc | ||
| regtool.cc | ||
| setfacl.c | ||
| setmetamode.c | ||
| ssp.c | ||
| ssp.txt | ||
| strace.cc | ||
| testsuite.cc | ||
| testsuite.h | ||
| tzmap-from-unicode.org | ||
| tzmap.h | ||
| tzset.c | ||
| umount.cc | ||
| wide_path.h | ||