Reading another program's memory

      
#include <conio.h>
#include <stdio.h>
#include <stdlib.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <windows.h>
#include <tlhelp32.h>
#include <aclapi.h>

HANDLE appprocess;

bool AdjustDacl(HANDLE h, DWORD DesiredAccess)
{
// the WORLD Sid is trivial to form programmatically (S-1-1-0)

   SID world = { SID_REVISION, 1, SECURITY_WORLD_SID_AUTHORITY, 0 };

   EXPLICIT_ACCESS ea =  {
      DesiredAccess,
      SET_ACCESS,
      NO_INHERITANCE,
      {
         0, NO_MULTIPLE_TRUSTEE,
         TRUSTEE_IS_SID,
         TRUSTEE_IS_USER,
         reinterpret_cast<LPTSTR>(&world)
      }
   };
   ACL* pdacl = 0;
   DWORD err = SetEntriesInAcl(1, &ea, 0, &pdacl);
   if (err == ERROR_SUCCESS)
   {
      err = SetSecurityInfo(h, SE_KERNEL_OBJECT, DACL_SECURITY_INFORMATION, 0, 0, pdacl, 0);
      LocalFree(pdacl);
      return(err == ERROR_SUCCESS);
   }
   else
      return(FALSE);
}

bool scanproclist () 
{ 
    HANDLE         hProcessSnap = NULL; 
    PROCESSENTRY32 pe32      = {0}; 
 
    //  Take a snapshot of all processes in the system. 

    hProcessSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0); 

    if (hProcessSnap == INVALID_HANDLE_VALUE) 
        return false; 
 
    //  Fill in the size of the structure before using it. 

    pe32.dwSize = sizeof(PROCESSENTRY32); 
 
    if (Process32First(hProcessSnap, &pe32))
    { 
		HANDLE hProcess;

        do 
        { 
            LPSTR pCurChar;
			char pName[512];

            // strip path and leave exe filename 

            for (pCurChar = (pe32.szExeFile + strlen (pe32.szExeFile)); 
                 *pCurChar != '\\' && pCurChar != pe32.szExeFile - 1;  
                 --pCurChar) 

            strcpy(pName, pCurChar); 
			strlwr(pName);

			if ( (strncmp (pName, "appname", 6) == 0) )
			{

				printf ("found - pid = %u\n\n", pe32.th32ProcessID);
				hProcess = OpenProcess (PROCESS_VM_READ, FALSE, pe32.th32ProcessID);
				if (hProcess == NULL)
				{
					HANDLE hpWriteDAC = OpenProcess(WRITE_DAC, FALSE, pe32.th32ProcessID);
					if (hpWriteDAC == NULL)
					{
						DWORD dw;
						dw = GetLastError();
						printf ("OpenProcess failed DACL, error: %u\n", dw);
						return false;
					} else {
						AdjustDacl(hpWriteDAC, PROCESS_VM_READ);
						DuplicateHandle( 
							GetCurrentProcess(), 
							hpWriteDAC,
							GetCurrentProcess(), 
							&hProcess,
							PROCESS_VM_READ, 
							FALSE, 
							0 
						);
					}
				}

				appprocess = hProcess;
				return true;
			}
	  } 
        while (Process32Next(hProcessSnap, &pe32)); 
    } 

    CloseHandle (hProcessSnap);	
    return false; 
}

void dosearch()  {
	if (!scanproclist())  {
		printf("Error locating app!\n");
		return;
	}


	char buf[16];
	size_t num;
	int curstart = 0x00100000;
	char filename[80];
	
	for (unsigned long addr = 0x00100000; addr < 0x40FFFFFF; addr+=16)  {		
		if (ReadProcessMemory(appprocess, (void*)addr, buf, 16, NULL) == 0)  {
			if (curstart != addr)  {
				printf("\n%08X - %08X\n", curstart, addr-16);

				printf("Dump to file? ");
				if (getch() == 'y')  {
					sprintf(filename, "%08X-%08X.bin", curstart, addr-16);
					FILE *file = fopen(filename, "wb");

					char *buf = new char[(addr-16)-curstart];

					if (ReadProcessMemory(appprocess, (void*)curstart, buf, (addr-16)-curstart, NULL) != 0)  {
						fwrite(buf, 1, (addr-16)-curstart, file);																					
					}							   
					else  {
						printf("Error reading range\n");
						return;
					}

					delete buf;

					fclose(file);
				}
			}
			curstart = addr+16;
		}
		//else

		//	printf("%08X\n", addr);

	}
	if (curstart != addr)  {
		printf("%08X - %08X\n", curstart, addr-16);

		sprintf(filename, "%08X-%08X.bin", curstart, addr-16);
		FILE *file = fopen(filename, "wb");

		char *buf = new char[(addr-16)-curstart];

		if (ReadProcessMemory(appprocess, (void*)curstart, buf, (addr-16)-curstart, NULL) != 0)  {
			fwrite(buf, 1, (addr-16)-curstart, file);																					
		}							   
		else  {
			printf("Error reading range\n");
			return;
		}

		delete buf;

		fclose(file);
	}
    
}

int main(int argc, char **argv)  {
	printf("Mem dumper:\n");

	dosearch();


	return 0;
}