Scrub through memory arbitrarily while avoiding Read Access Violations

0

I'm writing a debugging tool that takes a memory address from another process and displays the memory there and also all of the memory around it. Ordinarily, reading memory like this can cause a Read Access Violation depending on the address, but I don't want to crash if the user scrubs into memory the process doesn't own, or picks a weird address.

Given an address, even something sure to fail like 0x00000000, how can I try to access it without aborting my program if it's in violation?

c++
windows
debugging
memory
asked on Stack Overflow Nov 27, 2019 by Anne Quinn

1 Answer

1

VirtualQueryEx can be used to iterate all pages of any process you have access to in order to check page protection.

QueryWorkingSetEx is similar but filtered to paged in memory, otherwise known as the working set, and can provide more detailed information.

ReadProcessMemory is, at its most basic, a memcpy wrapped in an exception handler from kernel. You won't ever crash using this (properly) and can check GetLastError to see why any failures happened.

answered on Stack Overflow Nov 28, 2019 by Pickle Rick

User contributions licensed under CC BY-SA 3.0