[R00tKit]

hi
i search in web and find http://www.codeproject.com/KB/threads/MDumpAll.aspx but in this article the result dump file is very too large possibly it dump all dll and shared memory ! how can dump only process memory? and how can dump only Selected sections ?

thanks

[EP_X0FF]

It dump all sensitive regions.

You need to get ImageBase address and SizeofImage for process you want to dump.
You can do this with help of PSAPI GetModuleInformation.

After this ReadProcessMemory, write buffer to file.