Sign in to follow this  

Memory Scanner

This topic is 4416 days old which is more than the 365 day threshold we allow for new replies. Please post a new topic.

If you intended to correct an error in the post then please contact us.

Recommended Posts

I was wondering if anyone has a link to some source code for a memory scanner. I have been trying to write my own using OpenProcess and ReadProcessMemory, but I have run into a few snags that I think some working examples would help me fix. I'm trying to write a memory scanner that scans a selected process's memory for a certain value, or just dumps the memory to a file. I mainly need to figure out where the process's memory starts and ends. I attempted looping through the memory but it takes a little too long and I suspect it gets stuck somewhere around 0x0100000. I have already searched the forum for information, and I did find one post that was helpful, but I am still in need of help. Thanks in advance, VBStrider

Share this post


Link to post
Share on other sites
According to this vb example I found using google on ReadProcessMemory memory ~scan, the two functions you need in order to find an application's memory range are GetSystemInfo and VirtualQueryEx.

You might also need to use OpenProcessToken, LookupPrivilegeValue, and AdjustTokenPrivileges to grant your process the SE_DEBUG_NAME so you can manipulate other processes.

Share this post


Link to post
Share on other sites
Quote:
Original post by VBStrider
I mainly need to figure out where the process's memory starts and ends.


A process address space spans 4 gb - so it begins at 0x00000000 and ends at 0xFFFFFFFF. However, kernel space begins at 0x80000000 and a user mode program can't access addresses in kernel space without using a device driver or other tricks.

Share this post


Link to post
Share on other sites

This topic is 4416 days old which is more than the 365 day threshold we allow for new replies. Please post a new topic.

If you intended to correct an error in the post then please contact us.

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now

Sign in to follow this