Skip to main content
gamedev.net
🔒 Locked

Locked memory?

Started by klems Dec 23, 2002 at 4:17 PM 10 replies 500+ views
Original Post
klems
klems
Can anyone here with good knowledge of how Windows handles memory give me a clue on how I get which areas of another process''s RAM is available to alter with ReadProcessMemory and WriteProcessMemory under Windows XP? I''m writing a simple app which searches another program''s RAM, and lets you change interesting memory locations (like the cheat function of ZSNES). I''ve only managed to read the first 500 or so kilobytes after 0x00400000, then there''s some locked memory, and then theres another readable chunk, and then... [repeat until insanity sets in]


Three shall be the number thou shall count, and the number of the counting shall be three...

Witchcraven
Witchcraven
Im no expert on windows, but it would seem to me you would need a process running on a lower rung than the application you want to read. Its been a while since I have dealt with rungs and memory protection crap though. Can you run code in rung 0 on windows?
--------------------------I present for tribute this haiku:Inane Ravings OfThe Haunting JubilationA Mad Engineer©Copyright 2005 ExtrariusAll Rights Reserved
Evil Bill
Evil Bill
Semi-random guess:
If you can get the path to the executable, you can get the size of it. If you can get the size of the executable, you can determine how much data is allocated after 0x00400000. Maybe. You can get the address of the exe (if you don't already have it) from the ToolHelp functions ISTR [CreateToolhelp32Snapshot(), Process32First(), ...])

Edit: Actually, i'm talking crap :s That won't tell you anything abount memory allocated with new(), malloc(), etc...



[edited by - Evil Bill on December 23, 2002 8:17:25 PM]
Member of the Unban Mindwipe Society (UMWS)
DrPizza
DrPizza
IsBadReadPtr(), IsBadWritePtr(), IsBadCodePtr(), IsBadStringPtr() let you find out what you want to know.
char a[99999],*p=a;int main(int c,char**V){char*v=c>0?1[V]:(char*)V;if(c>=0)for(;*v&&93!=*v;){62==*v&&++p||60==*v&&--p||43==*v&&++*p||45==*v&&--*p||44==*v&&(*p=getchar())||46==*v&&putchar(*p)||91==*v&&(*p&&main(0,(char**)(--v+2))||(v=(char*)main(-1,(char**)++v)-1));++v;}else for(c=1;c;c+=(91==*v)-(93==*v),++v);return(int)v;} /*** drpizza@battleaxe.net ***/
klems
klems
Do they work with another process? I think they only work with your own memory...




Three shall be the number thou shall count, and the number of the counting shall be three...

DrPizza
DrPizza
I don''t see what difference it makes, really -- if you have an NT OS you can allocate memory in the other process, copy a function to that memory, and CreateRemoteThread() to begin execution within the other process.

But if that''s no good, perhaps you can use VirtualQueryEx() to obtain this information.
char a[99999],*p=a;int main(int c,char**V){char*v=c>0?1[V]:(char*)V;if(c>=0)for(;*v&&93!=*v;){62==*v&&++p||60==*v&&--p||43==*v&&++*p||45==*v&&--*p||44==*v&&(*p=getchar())||46==*v&&putchar(*p)||91==*v&&(*p&&main(0,(char**)(--v+2))||(v=(char*)main(-1,(char**)++v)-1));++v;}else for(c=1;c;c+=(91==*v)-(93==*v),++v);return(int)v;} /*** drpizza@battleaxe.net ***/
klems
klems
OK, thanks!




You have just read a controversial statement by Valderman. Thank you for your tolerance.

The Heretic
The Heretic
quote:
Original post by Witchcraven
Im no expert on windows, but it would seem to me you would need a process running on a lower rung than the application you want to read. Its been a while since I have dealt with rungs and memory protection crap though. Can you run code in rung 0 on windows?


It''s RING.
klems
klems
VirtualQueryEx worked fine to obtain information on which pages I could read - which created a new problem! I'm testing the search with a simple test app, which just displays the address and value of a two byte variable, and when I search for the value of that variable, I get about 35 results. It's just that the address of the var is 0x12ff7c, and the addresses found in the search are either below 0x500000 or 0x77e677ae and up.
Here's my search function:

  DWORD CALLBACK FindValue(LPVOID lpParam)
{
MEMORY_BASIC_INFORMATION m;
int nMatches = 0;
LPSEARCHINFO s = (LPSEARCHINFO)lpParam;
DWORD br, dwRegionSize, tmp;
char lpTxt[100];
unsigned char *lpSearchBuffer;

VirtualQueryEx(s->hProcess, (void *)0x00400000, &m, sizeof m);
dwRegionSize = m.RegionSize;
for(int i=(int)m.BaseAddress;i<0x80000000;i+=m.RegionSize)
{
VirtualQueryEx(s->hProcess, (void *)i, &m, sizeof m);
if(m.Protect != PAGE_NOACCESS)
{
lpSearchBuffer = new unsigned char[m.RegionSize];
ReadProcessMemory(s->hProcess, m.BaseAddress, lpSearchBuffer, m.RegionSize, &br);
if(br)
{
tmp = br - s->nSize;
for(DWORD j=0;j<=tmp;j++)
{
if(!memcmp(lpSearchBuffer+j, &s->dwValue, s->nSize))
{
nMatches++;
sprintf(lpTxt, "%x", i+j);
SendDlgItemMessage(s->hWnd, IDC_MATCHES, LB_ADDSTRING, 0, (LPARAM)lpTxt);
}
}
}
delete [] lpSearchBuffer;
}
SendDlgItemMessage(s->hWnd, IDC_PROGRESS1, PBM_STEPIT, 0, 0);
}

sprintf(lpTxt, "Found %d matches.", nMatches);
MessageBox(s->hWnd, lpTxt, "Search finished!", MB_ICONINFORMATION);
return 0;
}


Does anyone have a clue on what I'm doing wrong? It's probably something simple and obvious, but I've stared at this code for about an hour without finding it.

EDIT: Changed code tag to source tag




You have just read a controversial statement by Valderman. Thank you for your tolerance.

[edited by - Valderman on December 24, 2002 2:59:29 PM]

Leadorn
Leadorn
Read the registers in cpu, data segment...

Topic Locked

This topic has been locked by a moderator. New replies are not allowed.

Sign in to reply to this topic.