Scan computer memory

Question

How to search given sequence of bytes in a computer memory? ReadProcessMemory API does not suit because it only reads process memory, not whole memory.

Is there any existent solutions?

Answer 1

There's the Device\PhysicalMemory object, but mind that user-mode access is not permitted for some Windows versions (see the link). If you want to use it, you'll find this article useful (search for "5.2 chmod_mem.c" for some sample code).

Answer 2

Due to the virtual memory and paging, you may not find the sequence in the physical memory.

Enumerating the processes and heap walking is one way to scan the memory, except the kernel memory.