🔒 Locked

Memory Scanner

Started by VBStrider Nov 9, 2005 at 7:47 PM 2 replies 4.3k views

Original Post

Nov 9, 2005 at 7:47 PM

I was wondering if anyone has a link to some source code for a memory scanner. I have been trying to write my own using OpenProcess and ReadProcessMemory, but I have run into a few snags that I think some working examples would help me fix. I'm trying to write a memory scanner that scans a selected process's memory for a certain value, or just dumps the memory to a file. I mainly need to figure out where the process's memory starts and ends. I attempted looping through the memory but it takes a little too long and I suspect it gets stuck somewhere around 0x0100000. I have already searched the forum for information, and I did find one post that was helpful, but I am still in need of help. Thanks in advance, VBStrider

Extrarius

Nov 9, 2005 at 8:06 PM

According to this vb example I found using google on ReadProcessMemory memory ~scan, the two functions you need in order to find an application's memory range are GetSystemInfo and VirtualQueryEx.

You might also need to use OpenProcessToken, LookupPrivilegeValue, and AdjustTokenPrivileges to grant your process the SE_DEBUG_NAME so you can manipulate other processes.

LessBread

Nov 9, 2005 at 8:19 PM

Quote:
Original post by VBStrider
I mainly need to figure out where the process's memory starts and ends.

A process address space spans 4 gb - so it begins at 0x00000000 and ends at 0xFFFFFFFF. However, kernel space begins at 0x80000000 and a user mode program can't access addresses in kernel space without using a device driver or other tricks.

VBStrider

Nov 9, 2005 at 8:32 PM

Thanks Extrarius! That VB link was exactly what I've been looking for. :D

VBStrider

Topic Locked

This topic has been locked by a moderator. New replies are not allowed.