c# ReadProcessMemory - Reading address with a known value

0

Edit
I found that my handle is returning a value of zero. Is it not detecting the process?

Edit 2
Shortened the code and found the problem.
Answer posted.


Okay, so let's jump right in. I am attempting to read the value of an address that I know the value of, but for some reason I get a return value of "", essentially it is returning bytes of 00-00-00....etc.

My question: Is it my code or is it my address? I have another iteration of this code for 64bit that I tested on notepad and it works just fine; the code is almost identical to my 64bit code.

I have a feeling I may have to dig deeper and find more pointers and offsets and that the code is okay, but let's start with the code because I am new to all this coding stuff.

//Memory_Manager using_memory_manager = new Memory_Manager();
//Memory_Resources using_memory_resources = new Memory_Resources();
class Memory_Manager
{
    public string memory_manager(string _command, string _offset , string _panelid, string _typeid, string _textboxid)
    {
        var activeform = Application.OpenForms.OfType<Form1>().Single();
        Misc_Tools using_misc_tools = new Misc_Tools();
        Converters using_converters = new Converters();
        Splitters using_splitters = new Splitters();
        Form_Tools using_form_tools = new Form_Tools();
        Process[] p = Process.GetProcessesByName(activeform.comboBoxProcessList.Text);

        uint DELETE = 0x00010000;
        uint READ_CONTROL = 0x00020000;
        uint WRITE_DAC = 0x00040000;
        uint WRITE_OWNER = 0x00080000;
        uint SYNCHRONIZE = 0x00100000;
        uint END = 0xFFF; //if you have Windows XP or Windows Server 2003 you must change this to 0xFFFF
        uint PROCESS_ALL_ACCESS = (DELETE | READ_CONTROL | WRITE_DAC | WRITE_OWNER | SYNCHRONIZE | END);

        string gettext = using_form_tools.form_control_search(_panelid, _typeid, _textboxid);
        string _address = activeform.textBoxRead.Text;
        int object_size = Convert.ToInt32(activeform.textBoxObjectSize.Text); //set the size that will be array size
        byte[] readbuffer = new byte[object_size];//create an array of bytes for reading based on size
        byte[] bytestowrite = Encoding.Unicode.GetBytes(gettext);
        IntPtr ptrBytes;        
        IntPtr processHandle = Memory_Resources.OpenProcess(PROCESS_ALL_ACCESS, 1, Convert.ToInt32(p[0].Id));
        int size = gettext.Length*2;
        int bytesReaded;

        if (_address.Length == 11 && _command == "read")
        {
            Int64 _offsett = Int64.Parse(_offset, System.Globalization.NumberStyles.HexNumber);
            Int64 _address64bit = Int64.Parse(activeform.textBoxRead.Text, System.Globalization.NumberStyles.HexNumber);
            Int64 _finaladdress = _address64bit + _offsett;
            Console.WriteLine("Reading 64bit memory " + "\r\n" + "Address set to " + _finaladdress + "\r\n" + "Bytes to read set to " + object_size + "\r\n");
            activeform.textBoxUpdate.AppendText("Reading 64bit memory " + "\r\n" + "Address set to " + _finaladdress + "\r\n" + "Bytes to read set to " + object_size + "\r\n");
            Memory_Resources.ReadProcessMemory(processHandle, _finaladdress, readbuffer, object_size, out ptrBytes);
            bytesReaded = ptrBytes.ToInt32();
            Memory_Resources.CloseHandle(processHandle);
            return Encoding.Unicode.GetString(readbuffer);
        }            
        else if (_address.Length == 8 && _command == "read")
        {
            Int32 _offsett = Int32.Parse(_offset, System.Globalization.NumberStyles.HexNumber);
            Int32 _address32bit = Int32.Parse(activeform.textBoxRead.Text, System.Globalization.NumberStyles.HexNumber);
            Int32 _finaladdress = _address32bit + _offsett;
            Console.WriteLine("Reading 32bit memory " + "\r\n" + "Address set to " + _finaladdress + "\r\n" + "Bytes to read set to " + object_size + "\r\n");
            activeform.textBoxUpdate.AppendText("Reading 64bit memory " + "\r\n" + "Address set to " + _finaladdress + "\r\n" + "Bytes to read set to " + object_size + "\r\n");
            Memory_Resources.ReadProcessMemory(processHandle, _finaladdress, readbuffer, object_size, out ptrBytes);
            bytesReaded = ptrBytes.ToInt32();
            Memory_Resources.CloseHandle(processHandle);
            return Encoding.Unicode.GetString(readbuffer);
        }
        else if (_address.Length == 11 && _command == "write")
        {
            Int64 _offsett = Int64.Parse(_offset, System.Globalization.NumberStyles.HexNumber);
            Int64 _address64bit = Int64.Parse(activeform.textBoxRead.Text, System.Globalization.NumberStyles.HexNumber);
            Int64 _finaladdress = _address64bit + _offsett;
            Console.WriteLine("Writing 64bit memory " + "\r\n" + "Address set to " + _finaladdress + "\r\n" + "Bytes to write set to " + Encoding.Unicode.GetString(bytestowrite) + "\r\n");
            activeform.textBoxUpdate.AppendText("Reading 64bit memory " + "\r\n" + "Address set to " + _finaladdress + "\r\n" + "Bytes to read set to " + object_size + "\r\n");
            Memory_Resources.WriteProcessMemory(processHandle, _finaladdress, bytestowrite, size, out ptrBytes);
            bytesReaded = ptrBytes.ToInt32();
            Memory_Resources.CloseHandle(processHandle);
            return BitConverter.ToString(bytestowrite);
        }
        else if (_address.Length == 8 && _command == "write")
        {
            Int32 _offsett = Int32.Parse(_offset, System.Globalization.NumberStyles.HexNumber);
            Int32 _address32bit = Int32.Parse(activeform.textBoxRead.Text, System.Globalization.NumberStyles.HexNumber);
            Int32 _finaladdress = _address32bit + _offsett;
            Console.WriteLine("Writing 32bit memory " + "\r\n" + "Address set to " + _finaladdress + "\r\n" + "Bytes to write set to " + Encoding.Unicode.GetString(bytestowrite) + "\r\n");
            activeform.textBoxUpdate.AppendText("Reading 64bit memory " + "\r\n" + "Address set to " + _finaladdress + "\r\n" + "Bytes to read set to " + object_size + "\r\n");
            Memory_Resources.WriteProcessMemory(processHandle, _finaladdress, bytestowrite, size, out ptrBytes);
            bytesReaded = ptrBytes.ToInt32();
            Memory_Resources.CloseHandle(processHandle);
            return BitConverter.ToString(bytestowrite);
        }
        return ("Could not read memory " + "\r\n");
    }
}

class Memory_Resources
{
    [DllImport("kernel32.dll")]
    public static extern bool ReadProcessMemory(IntPtr hProcess, Int32 lpBaseAddress, byte[] buffer, int size, out IntPtr lpNumberOfBytesRead);

    [DllImport("kernel32.dll")]
    public static extern bool ReadProcessMemory(IntPtr hProcess, Int64 lpBaseAddress, byte[] buffer, int size, out IntPtr lpNumberOfBytesRead);

    [DllImport("kernel32.dll")]
    public static extern bool WriteProcessMemory(IntPtr hProcess, Int32 lpBaseAddress, byte[] buffer, int size, out IntPtr lpNumberOfBytesWritten);

    [DllImport("kernel32.dll")]
    public static extern bool WriteProcessMemory(IntPtr hProcess, Int64 lpBaseAddress, byte[] buffer, int size, out IntPtr lpNumberOfBytesWritten);

    [DllImport("kernel32.dll")]
    public static extern IntPtr OpenProcess(uint dwDesiredAccess, Int32 bInheritHandle, Int32 dwProcessId);

    [DllImport("kernel32.dll")]
    public static extern Int32 CloseHandle(IntPtr hObject);
}
c#
memory
offset
type-conversion
memory-address
asked on Stack Overflow May 6, 2016 by 2bytes • edited May 9, 2016 by Clijsters

1 Answer

0

The previous code was using information from a different textBox, which is why it was not returning the correct value I wanted to read.

Essentially it was user error.

answered on Stack Overflow May 9, 2016 by 2bytes • edited May 9, 2016 by 2bytes

User contributions licensed under CC BY-SA 3.0