Edit
I found that my handle is returning a value of zero. Is it not detecting the process?
Edit 2
Shortened the code and found the problem.
Answer posted.
Okay, so let's jump right in. I am attempting to read the value of an address that I know the value of, but for some reason I get a return value of ""
, essentially it is returning bytes of 00-00-00....etc.
My question: Is it my code or is it my address? I have another iteration of this code for 64bit that I tested on notepad and it works just fine; the code is almost identical to my 64bit code.
I have a feeling I may have to dig deeper and find more pointers and offsets and that the code is okay, but let's start with the code because I am new to all this coding stuff.
//Memory_Manager using_memory_manager = new Memory_Manager();
//Memory_Resources using_memory_resources = new Memory_Resources();
class Memory_Manager
{
public string memory_manager(string _command, string _offset , string _panelid, string _typeid, string _textboxid)
{
var activeform = Application.OpenForms.OfType<Form1>().Single();
Misc_Tools using_misc_tools = new Misc_Tools();
Converters using_converters = new Converters();
Splitters using_splitters = new Splitters();
Form_Tools using_form_tools = new Form_Tools();
Process[] p = Process.GetProcessesByName(activeform.comboBoxProcessList.Text);
uint DELETE = 0x00010000;
uint READ_CONTROL = 0x00020000;
uint WRITE_DAC = 0x00040000;
uint WRITE_OWNER = 0x00080000;
uint SYNCHRONIZE = 0x00100000;
uint END = 0xFFF; //if you have Windows XP or Windows Server 2003 you must change this to 0xFFFF
uint PROCESS_ALL_ACCESS = (DELETE | READ_CONTROL | WRITE_DAC | WRITE_OWNER | SYNCHRONIZE | END);
string gettext = using_form_tools.form_control_search(_panelid, _typeid, _textboxid);
string _address = activeform.textBoxRead.Text;
int object_size = Convert.ToInt32(activeform.textBoxObjectSize.Text); //set the size that will be array size
byte[] readbuffer = new byte[object_size];//create an array of bytes for reading based on size
byte[] bytestowrite = Encoding.Unicode.GetBytes(gettext);
IntPtr ptrBytes;
IntPtr processHandle = Memory_Resources.OpenProcess(PROCESS_ALL_ACCESS, 1, Convert.ToInt32(p[0].Id));
int size = gettext.Length*2;
int bytesReaded;
if (_address.Length == 11 && _command == "read")
{
Int64 _offsett = Int64.Parse(_offset, System.Globalization.NumberStyles.HexNumber);
Int64 _address64bit = Int64.Parse(activeform.textBoxRead.Text, System.Globalization.NumberStyles.HexNumber);
Int64 _finaladdress = _address64bit + _offsett;
Console.WriteLine("Reading 64bit memory " + "\r\n" + "Address set to " + _finaladdress + "\r\n" + "Bytes to read set to " + object_size + "\r\n");
activeform.textBoxUpdate.AppendText("Reading 64bit memory " + "\r\n" + "Address set to " + _finaladdress + "\r\n" + "Bytes to read set to " + object_size + "\r\n");
Memory_Resources.ReadProcessMemory(processHandle, _finaladdress, readbuffer, object_size, out ptrBytes);
bytesReaded = ptrBytes.ToInt32();
Memory_Resources.CloseHandle(processHandle);
return Encoding.Unicode.GetString(readbuffer);
}
else if (_address.Length == 8 && _command == "read")
{
Int32 _offsett = Int32.Parse(_offset, System.Globalization.NumberStyles.HexNumber);
Int32 _address32bit = Int32.Parse(activeform.textBoxRead.Text, System.Globalization.NumberStyles.HexNumber);
Int32 _finaladdress = _address32bit + _offsett;
Console.WriteLine("Reading 32bit memory " + "\r\n" + "Address set to " + _finaladdress + "\r\n" + "Bytes to read set to " + object_size + "\r\n");
activeform.textBoxUpdate.AppendText("Reading 64bit memory " + "\r\n" + "Address set to " + _finaladdress + "\r\n" + "Bytes to read set to " + object_size + "\r\n");
Memory_Resources.ReadProcessMemory(processHandle, _finaladdress, readbuffer, object_size, out ptrBytes);
bytesReaded = ptrBytes.ToInt32();
Memory_Resources.CloseHandle(processHandle);
return Encoding.Unicode.GetString(readbuffer);
}
else if (_address.Length == 11 && _command == "write")
{
Int64 _offsett = Int64.Parse(_offset, System.Globalization.NumberStyles.HexNumber);
Int64 _address64bit = Int64.Parse(activeform.textBoxRead.Text, System.Globalization.NumberStyles.HexNumber);
Int64 _finaladdress = _address64bit + _offsett;
Console.WriteLine("Writing 64bit memory " + "\r\n" + "Address set to " + _finaladdress + "\r\n" + "Bytes to write set to " + Encoding.Unicode.GetString(bytestowrite) + "\r\n");
activeform.textBoxUpdate.AppendText("Reading 64bit memory " + "\r\n" + "Address set to " + _finaladdress + "\r\n" + "Bytes to read set to " + object_size + "\r\n");
Memory_Resources.WriteProcessMemory(processHandle, _finaladdress, bytestowrite, size, out ptrBytes);
bytesReaded = ptrBytes.ToInt32();
Memory_Resources.CloseHandle(processHandle);
return BitConverter.ToString(bytestowrite);
}
else if (_address.Length == 8 && _command == "write")
{
Int32 _offsett = Int32.Parse(_offset, System.Globalization.NumberStyles.HexNumber);
Int32 _address32bit = Int32.Parse(activeform.textBoxRead.Text, System.Globalization.NumberStyles.HexNumber);
Int32 _finaladdress = _address32bit + _offsett;
Console.WriteLine("Writing 32bit memory " + "\r\n" + "Address set to " + _finaladdress + "\r\n" + "Bytes to write set to " + Encoding.Unicode.GetString(bytestowrite) + "\r\n");
activeform.textBoxUpdate.AppendText("Reading 64bit memory " + "\r\n" + "Address set to " + _finaladdress + "\r\n" + "Bytes to read set to " + object_size + "\r\n");
Memory_Resources.WriteProcessMemory(processHandle, _finaladdress, bytestowrite, size, out ptrBytes);
bytesReaded = ptrBytes.ToInt32();
Memory_Resources.CloseHandle(processHandle);
return BitConverter.ToString(bytestowrite);
}
return ("Could not read memory " + "\r\n");
}
}
class Memory_Resources
{
[DllImport("kernel32.dll")]
public static extern bool ReadProcessMemory(IntPtr hProcess, Int32 lpBaseAddress, byte[] buffer, int size, out IntPtr lpNumberOfBytesRead);
[DllImport("kernel32.dll")]
public static extern bool ReadProcessMemory(IntPtr hProcess, Int64 lpBaseAddress, byte[] buffer, int size, out IntPtr lpNumberOfBytesRead);
[DllImport("kernel32.dll")]
public static extern bool WriteProcessMemory(IntPtr hProcess, Int32 lpBaseAddress, byte[] buffer, int size, out IntPtr lpNumberOfBytesWritten);
[DllImport("kernel32.dll")]
public static extern bool WriteProcessMemory(IntPtr hProcess, Int64 lpBaseAddress, byte[] buffer, int size, out IntPtr lpNumberOfBytesWritten);
[DllImport("kernel32.dll")]
public static extern IntPtr OpenProcess(uint dwDesiredAccess, Int32 bInheritHandle, Int32 dwProcessId);
[DllImport("kernel32.dll")]
public static extern Int32 CloseHandle(IntPtr hObject);
}
The previous code was using information from a different textBox, which is why it was not returning the correct value I wanted to read.
Essentially it was user error.
User contributions licensed under CC BY-SA 3.0