Good day! I ask for help in the matter of reading memory. I am getting a MEMORY_BASIC_INFORMATION structure about a certain region that I need to read. The field AllocationProtect set to PAGE_EXECUTE_WRITECOPY (i.e. it cannot be read), and the field Protect set to PAGE_READWRITE . I need to BaseAddress RegionSize it by BaseAddress RegionSize bytes, and not by AllocationBase . However, despite the fact that this region has PAGE_READWRITE , ReadProcessMemory still gives the 998th error. What cant? Thank you in advance

Here is the function code.

  PBYTE FindAndWrite(HANDLE hProcess, PBYTE pRegionAddress, DWORD dwRegionSize, DWORD dwSignature) { //в pRegionAddress передаётся поле BaseAddress структуры MEMORY_BASIC_INFORMATION PBYTE pCurrentAddress = pRegionAddress; char cDebugMessage[100]; DWORD i = 0; DWORD dwBuffer = 0; DWORD dwBytesRead = 0; for(i;i<dwRegionSize-4;i++) { if (!ReadProcessMemory(hProcess,pCurrentAddress,&dwBuffer,4,&dwBytesRead) { wsprintf(cDebugMessage,"Can't read some memory - Error %d",GetLastError()); ShowError(cDebugMessage); } else { //...обработка } pCurrentAddress++; } } 
  • A brief overview of the Internet showed that ::ReadProcessMemory can return ERROR_NOACCESS if you pass the wrong buffer to it. Therefore, please attach a code snippet with a call to this function. - atwice 8:50 pm
  • Added a code to the post ... - zMaXz

0