Dump executable memory regions content : A project i'm working on requires me to log every executable regions content, at any time. 
By 'log', i mean:

 - Save the content of the pages into a file.
 - Save the range addresses of the regions into a file.
 - Intercept changes in the address you've already saved, update the log file
   with the new content of the pages.

My current implementation assumes DEP support, and it is a simple automata:

 1. Inject a DLL into the process before the entry point is executed.
 2. Register an exception handler via: `AddVectoredExceptionHandler`
 3. Iterate on the process virtual memory layout(Using `VirtualQueryEx`) log every executable region, and turn off the execute permission(if exists) for that region.
 4. Hook `NtProtectVirtualMemory`, `NtAllocateVirtualMemory`.
 4. Jump to the process's entry point.

If someone changed a region protection to: `PAGE_EXECUTE_READWRITE` `PAGE_EXECUTE` `PAGE_EXECUTE_READ`, i intercept that in the Ntdll hooks, disable the execute permission for these pages, and log them.

Now, everytime an exception is thrown, i check if the address that triggered the exception is caused by any of the regions that i logged. If it did, it means that someone tried to execute one of the pages, so i turn on the execute permission via `VirtualProtect`, and turn of the write permission(if present)

Next, if i get an exception for the same region, it means that the process tried to write to it, so i enable the write permission, and disable the execute.

Next time i get an exception, i will log the region.

This method seems to work on 99% of the cases, but results in very poor performence and massive process flow interference. Also, it seems that i don't catch every exception, so on some application just crash because i can't enable the execution.

Any ideas on how to improve performence / use a whole new method?




