Good day! I ask for help in the matter of reading memory. I am getting a MEMORY_BASIC_INFORMATION
structure about a certain region that I need to read. The field AllocationProtect
set to PAGE_EXECUTE_WRITECOPY
(i.e. it cannot be read), and the field Protect
set to PAGE_READWRITE
. I need to BaseAddress RegionSize
it by BaseAddress RegionSize
bytes, and not by AllocationBase
. However, despite the fact that this region has PAGE_READWRITE
, ReadProcessMemory
still gives the 998th error. What cant? Thank you in advance
Here is the function code.
PBYTE FindAndWrite(HANDLE hProcess, PBYTE pRegionAddress, DWORD dwRegionSize, DWORD dwSignature) { //в pRegionAddress передаётся поле BaseAddress структуры MEMORY_BASIC_INFORMATION PBYTE pCurrentAddress = pRegionAddress; char cDebugMessage[100]; DWORD i = 0; DWORD dwBuffer = 0; DWORD dwBytesRead = 0; for(i;i<dwRegionSize-4;i++) { if (!ReadProcessMemory(hProcess,pCurrentAddress,&dwBuffer,4,&dwBytesRead) { wsprintf(cDebugMessage,"Can't read some memory - Error %d",GetLastError()); ShowError(cDebugMessage); } else { //...обработка } pCurrentAddress++; } }
::ReadProcessMemory
can returnERROR_NOACCESS
if you pass the wrong buffer to it. Therefore, please attach a code snippet with a call to this function. - atwice 8:50 pm