Three shall be the number thou shall count, and the number of the counting shall be three...
Locked memory?
Author
Can anyone here with good knowledge of how Windows handles memory give me a clue on how I get which areas of another process''s RAM is available to alter with ReadProcessMemory and WriteProcessMemory under Windows XP?
I''m writing a simple app which searches another program''s RAM, and lets you change interesting memory locations (like the cheat function of ZSNES). I''ve only managed to read the first 500 or so kilobytes after 0x00400000, then there''s some locked memory, and then theres another readable chunk, and then... [repeat until insanity sets in]
Im no expert on windows, but it would seem to me you would need a process running on a lower rung than the application you want to read. Its been a while since I have dealt with rungs and memory protection crap though. Can you run code in rung 0 on windows?
Semi-random guess:
If you can get the path to the executable, you can get the size of it. If you can get the size of the executable, you can determine how much data is allocated after 0x00400000. Maybe. You can get the address of the exe (if you don't already have it) from the ToolHelp functions ISTR [CreateToolhelp32Snapshot(), Process32First(), ...])
Edit: Actually, i'm talking crap :s That won't tell you anything abount memory allocated with new(), malloc(), etc...
[edited by - Evil Bill on December 23, 2002 8:17:25 PM]
If you can get the path to the executable, you can get the size of it. If you can get the size of the executable, you can determine how much data is allocated after 0x00400000. Maybe. You can get the address of the exe (if you don't already have it) from the ToolHelp functions ISTR [CreateToolhelp32Snapshot(), Process32First(), ...])
Edit: Actually, i'm talking crap :s That won't tell you anything abount memory allocated with new(), malloc(), etc...
[edited by - Evil Bill on December 23, 2002 8:17:25 PM]
IsBadReadPtr(), IsBadWritePtr(), IsBadCodePtr(), IsBadStringPtr() let you find out what you want to know.
Author
Do they work with another process? I think they only work with your own memory...
Three shall be the number thou shall count, and the number of the counting shall be three...
I don''t see what difference it makes, really -- if you have an NT OS you can allocate memory in the other process, copy a function to that memory, and CreateRemoteThread() to begin execution within the other process.
But if that''s no good, perhaps you can use VirtualQueryEx() to obtain this information.
But if that''s no good, perhaps you can use VirtualQueryEx() to obtain this information.
Author
OK, thanks!
You have just read a controversial statement by Valderman. Thank you for your tolerance.
You can absolutely access other processes'' memory with ReadProcessMemory/WriteProcessMemory (that''s how a debugger does it), but the problem is to find what addresses to read from. What memory are you trying to read? It''s as you understand almost impossible to read the value of a stack variable for a thread that calls a function unless you write a debugger and single-step the program. In order to read memory, your chance is if that memory is long-lived and allocated from the heap.
The IsBad*Ptr() family of functions works for the current process, so that will work only if you create a remote thread in the process you want to search in.
In order to search, you might want to suspend all threads in the process while searching.
The IsBad*Ptr() family of functions works for the current process, so that will work only if you create a remote thread in the process you want to search in.
In order to search, you might want to suspend all threads in the process while searching.
quote:Original post by Witchcraven
Im no expert on windows, but it would seem to me you would need a process running on a lower rung than the application you want to read. Its been a while since I have dealt with rungs and memory protection crap though. Can you run code in rung 0 on windows?
It''s RING
.
quote:Original post by WitchcravenYou can run code in ring 0 ("kernel mode" in Windows terms) if you write a device driver, but you don''t need this to read another process'' memory. Either you can attach as a debugger, create a remote thread, or register a dll that gets loaded for each program started and in that way access the memory of a certain process.
Im no expert on windows, but it would seem to me you would need a process running on a lower rung than the application you want to read. Its been a while since I have dealt with rungs and memory protection crap though. Can you run code in rung 0 on windows?
In order to debug or attach remote threads, you need to run as administrator (or in some other way adjust security so you get sufficient rights). Normal low-priviliged users would not be able to do this as it would clearly be a security issue.
This topic is closed to new replies.
Advertisement
Popular Topics
Advertisement
