Click here to Skip to main content
Click here to Skip to main content

Windows NT class for direct memory access

, 14 Oct 2002
Rate this:
Please Sign up or sign in to vote.
A simple class which simplifies reading memory from any process.

Sample Image

Introduction

I've always wondered how debuggers could read and edit the memory of ordinary programs. I used to think it was a complicated process and that it involved low-level programming techniques. Much to my disappointment, I couldn't find any articles covering this subject.

After some research (and asking around on the boards) I found it's possible to read the memory of processes by calling a few Win32 APIs. It only works under WinNT with admin access, though.

How does the class work?

Basically, there are two things that need to be done in order to get full memory access.

  • Getting the Process ID of the program that needs debugging. This can be easily achieved using GetWindowThreadProcessId(hWnd, The_Process_ID)

  • Opening the process :

    handle_to_Process = OpenProcess(PROCESS_VM_READ
                |PROCESS_VM_WRITE|     
                PROCESS_VM_OPERATION    
                |PROCESS_QUERY_INFORMATION, 
                FALSE, The_Process_ID);

Reading and writing to the memory

Now we have a handle to an opened process, we can write and read at will.

    DWORD iAddress = 0x234343;
    DWORD dummy;
    int value;

    if (!ReadProcessMemory(handle_to_Process    // handle to the process whose 
                                                // memory is read
            ,(void*) iAddress,     // address to start reading
            (void*) &value,        // address of buffer to place read data
            sizeof(value)          // number of bytes to read
            ,&dummy))              // address of number of bytes read
    {
        m_sError = _T("Failed to read memory.");
        return FALSE;
    }

The last parameter doesn't contain valuable information. It can be used to check how many bytes are actually written into the memory, but if one uses fixed sized variables there's nothing that can go wrong.

The CProcessMem class

This class makes editing memory even easier, it has the following functions:

    bool InitModule (HWND hWnd);        // Hook to a process identified by a hWnd
    bool InitModule (DWORD processID);       // Or you can just use the pID
    bool InitModule (CString wndTitle);      // And the easiest way, the window text.
    
    bool ReadVal    (DWORD iAddress, BYTE &value);
    bool WriteVal    (DWORD iAddress, BYTE value);

    bool ReadVal    (DWORD iAddress, short int &value);
    bool WriteVal    (DWORD iAddress, short int value);
    
    bool ReadVal    (DWORD iAddress, int &value);
    bool WriteVal    (DWORD iAddress, int value);

    bool ReadVal    (DWORD iAddress, CString &text);
    bool WriteVal    (DWORD iAddress, CString text);

At the moment there is no support for searching within the virtual memory. It can be done fairly easily with QueryVirtualEx() though.

Notes:

  • All functions return a boolean value. If a function returns FALSE, then you can get a more specific error message by checking CProcessMem::m_sError
  • The ProcessInfo structure contains information on the process. For instance: After you ran CProcessMem::InitModule("A window Caption") you can get the process ID by checking CProcessMem::ProcessInfo.pID
  • Although I'm fairly sure this code works well, don't be surprised to find a bug. If you do, please contact me.
  • I hope somebody finds this class useful.

License

This article has no explicit license attached to it but may contain usage terms in the article text or the download files themselves. If in doubt please contact the author via the discussion board below.

A list of licenses authors might use can be found here

Share

About the Author

generic_user_id

Netherlands Netherlands
No Biography provided

Comments and Discussions

 
GeneralBase Class 'CWnd' not defined Pinmembermactrent9-Jul-10 11:07 
Generalaccessing pci memory Pinmemberadrianuswiedewanus28-Sep-06 5:25 
Questionmagic? PinmemberSimoyd2-Mar-04 17:28 
m_sByte = "0x0012FE80";
m_sShort = "0x0012FE82";
m_sInt = "0x0012FE84";
m_sString= "0x007A1EE4";
 
i feel as if you are missing a key part of this example and pulling numbbers out of your ass (excuse the expression Smile | :)
 
how would i find the base address of a program to start looking in? (say i typed "hello" in notepad and i wanted to search the memory that notepad is using for it)
 
how do i know what address notepad starts at and what address it ends at? does it even work that way? can i search a range like that?
GeneralReadProcessMemory Pinmembermaddiver10-Aug-03 14:20 
Generaldma to 16-bit application running in a VDM Pinmemberthom_as26-Feb-03 5:56 
QuestionMemory addresses ? PinmemberJerry Evans21-Jan-03 11:02 
Generalnice project PinmemberCodeFlatter4-Dec-02 7:09 
Generalhow u can help me? PinmemberCodeFlatter4-Dec-02 7:47 
GeneralRe: how u can help me? PinmemberGriffith Sutherns5-Dec-02 2:36 
Generalthank you for help!!! PinmemberCodeFlatter5-Dec-02 22:53 
QuestionAdmin? PinmemberAndreas Saurwein16-Oct-02 6:20 
AnswerRe: Admin? PinmemberGriffith Sutherns16-Oct-02 7:55 
GeneralRe: Admin? PinmemberAndreas Saurwein16-Oct-02 8:40 
GeneralRe: Admin? PinmemberGriffith Sutherns16-Oct-02 9:19 
GeneralRe: Admin? PinmemberAndreas Saurwein17-Oct-02 2:32 
GeneralRe: Admin? PinmemberGriffith Sutherns17-Oct-02 5:01 
GeneralRe: Admin? PinmemberAndreas Saurwein17-Oct-02 5:45 
GeneralRe: Admin? PinsussAnonymous27-Oct-02 19:57 

General General    News News    Suggestion Suggestion    Question Question    Bug Bug    Answer Answer    Joke Joke    Rant Rant    Admin Admin   

Use Ctrl+Left/Right to switch messages, Ctrl+Up/Down to switch threads, Ctrl+Shift+Left/Right to switch pages.

| Advertise | Privacy | Terms of Use | Mobile
Web04 | 2.8.1411022.1 | Last Updated 15 Oct 2002
Article Copyright 2002 by generic_user_id
Everything else Copyright © CodeProject, 1999-2014
Layout: fixed | fluid