Reading a process' memory

Question

So i have this function iv'e written in C, it's supposed to scan a process' memory. I'm running it on notepad, but since it's failing iv'e tried a few more processes. It never works properly and the output is always as follows :

0x00010000
0x7FFE0000
0x7FFE1000

When i'm using windows 7 the function works just fine. Here it is :

int ScanProcess(int pid)
{
    HANDLE hProc;
    SYSTEM_INFO si;
    MEMORY_BASIC_INFORMATION mbi;
    LPVOID *minAddress, *maxAddress;

    GetSystemInfo(&si);
    minAddress = si.lpMinimumApplicationAddress;
    maxAddress = si.lpMaximumApplicationAddress;

    hProc = OpenProcess(PROCESS_ALL_ACCESS, NULL, pid);

    if (!hProc) {
        printf("[-] OpenProcess() failed.\n");
        return 0;}

    while (minAddress < maxAddress)
    {
        printf("0x%08X\n", minAddress);
        if(!VirtualQueryEx(hProc, minAddress, &mbi, sizeof(mbi))) printf("[-] VirtualQueryEx() failed. %d\n", GetLastError());
        if (mbi.State == MEM_COMMIT && mbi.Protect == PAGE_READWRITE)
        {
            printf("MEM_COMMIT\n"); //When the scan would work i will read the memory and work with it.
        }
        minAddress = (LPVOID)((long)mbi.BaseAddress + mbi.RegionSize);
    }

    return 0;
}

Can someone figure out the problem? thanks :)

@Harry Johnston, this is what i got so far.

int ScanProcess(int pid)
{
HANDLE hProc;
SYSTEM_INFO si;
MEMORY_BASIC_INFORMATION mbi;
DWORD64 minAddress, maxAddress;

GetSystemInfo(&si);
minAddress = (DWORD64)si.lpMinimumApplicationAddress;
maxAddress = (DWORD64)si.lpMaximumApplicationAddress;

hProc = OpenProcess(PROCESS_ALL_ACCESS, NULL, pid);

if (!hProc) {
    printf("[-] OpenProcess() failed.\n");
    return 0;}

while (minAddress < maxAddress)
{
    printf("0x%08X\n", minAddress);
    if(!VirtualQueryEx(hProc, (LPCVOID)minAddress, &mbi, sizeof(mbi))) printf("[-] VirtualQueryEx() failed. %d\n", GetLastError());
    if (mbi.State == MEM_COMMIT && mbi.Protect == PAGE_READWRITE)
    {
        printf("MEM_COMMIT\n"); //When the scan would work i will read the memory and work with it.
    }
    minAddress = (DWORD64)mbi.BaseAddress + mbi.RegionSize;
}

return 0;
}

I don't know if it's related, but you have one too many levels of indirection. minAddress and maxAddress should be LPVOID, not LPVOID*, — Jonathan Potter
– Jonathan Potter, Commented Sep 24, 2015 at 18:17
that's right. anyway, i changed them to just LPVOID and the output remained same. — hyprnir
– hyprnir, Commented Sep 24, 2015 at 18:24
Can you be more specific what you mean by "never works properly"? Step through the code in a debugger and clarify which step does not do what you expect. — Raymond Chen
– Raymond Chen, Commented Sep 24, 2015 at 19:05
VirtualQueryEx returns the addresses for every process, and there's never a memory block i can work with. the if statement that checks. mbi.State and mbi.Protect is never true. on windows 7 the code behaves completely different — hyprnir
– hyprnir, Commented Sep 24, 2015 at 19:10
what do you mean by: "the code behaves completely different"? — user3629249
– user3629249, Commented Sep 24, 2015 at 20:35

Jonathan Potter · Accepted Answer · 2015-09-25 00:09:30Z

3

Try this version:

int ScanProcess(int pid)
{
    HANDLE hProc;
    SYSTEM_INFO si;
    MEMORY_BASIC_INFORMATION mbi;
    LPVOID minAddress, maxAddress;

    GetSystemInfo(&si);
    minAddress = si.lpMinimumApplicationAddress;
    maxAddress = si.lpMaximumApplicationAddress;

    hProc = OpenProcess(PROCESS_ALL_ACCESS, NULL, pid);

    if (!hProc) {
        printf("[-] OpenProcess() failed.\n");
        return 0;}

    while (minAddress < maxAddress)
    {
        printf("0x%p\n", minAddress);
        if(!VirtualQueryEx(hProc, minAddress, &mbi, sizeof(mbi))) printf("[-] VirtualQueryEx() failed. %d\n", GetLastError());
        if (mbi.State == MEM_COMMIT && mbi.Protect == PAGE_READWRITE)
        {
            printf("MEM_COMMIT\n"); //When the scan would work i will read the memory and work with it.
        }
        minAddress = (LPBYTE)mbi.BaseAddress + mbi.RegionSize;
    }

    return 0;
}

It uses LPVOID as a pointer type is fine for this application, the only real change is the pointer arithmetic is done using a cast to LPBYTE (since you can't add void pointers).

The other change is to use %p as the printf formatting string, since this will work correctly with a 64-bit pointer.

answered Sep 25, 2015 at 0:09

Jonathan Potter

37.5k4 gold badges73 silver badges86 bronze badges

Sign up to request clarification or add additional context in comments.

7 Comments

hyprnir Over a year ago

It works! thanks a lot, i started getting frustrated. the %p is new to me and i understand its usage so thanks for that. can you explain me the logic of using LPBYTE and why it works?

Jonathan Potter Over a year ago

@hyprnir LPBYTE is a byte-sized pointer, and since mbi.RegionSize is measured in bytes you need to use a compatible pointer size for the arithmetic to work.

hyprnir Over a year ago

i tried using char* and it wouldn't work. iv'e done some reading and found out that LPBYTE is unsigned char*. can you explain me the difference between char* and unsigned char* when working with pointers?

Jonathan Potter Over a year ago

@hyprnir char* works as well (I just tried it). There's no difference in this case between the two - they're both byte-sized pointers. The only difference comes when dereferencing the pointer which you're not doing in this code.

hyprnir Over a year ago

what do you mean by dereferencing a pointer? you mind writing a little example?

|

Collectives™ on Stack Overflow

Reading a process' memory

1 Answer 1

7 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

7 Comments

Your Answer

Sign up or log in

Post as a guest

Related