[Autogenerated] let's see an example for reading memory from other processes.
I create an application here called memory and other project
here in the same solution Visual Studio added the classic
includes window dot h and S D I O.
But we want to do here is to be able to use any process at
least try to use any process provided by the client and read
some memory from some address.
So let's start by accepting the parameters here by
reading from the command line.
So what I want to get here, I want to have at least two parameters.
In fact exactly two parameters.
And those would be the process I.
D.
And the address to read from maybe even a number of
bytes if you want to do that.
But we'll just use something simple and constant for now.
So the usage would be just use memory with the process I.
D.
And the address and we'll try to accept the address in
hexadecimal So once we have a process I.
D.
We can start working with it.
So first the process,
IDE itself is going to be available using the first parameter.
So I'm going to convert that to an integer from an ask
string that's going to be an R V run,
remember that R V zero is the executable name itself.
So now we first have to open the handle to the process using the open process
API and for the open process API to provide us what we need.
We have to open the process with the process being read access mask.
Otherwise the read process,
memory p I has no chance of working so I want to specify the process I.
D.
Here if the handle to the process is now,
which means that we can't get a handle to the process then something went wrong.
And one of the cases that could be is that the process
might not be um might not exist.
Maybe the process is just bogus I.
D.
But could be some other things such as the process being too
protected for us to access in such a way.
So I'm just going to display whatever get last error has to
say and we can interpret that as required.
Once we have handled to the process ready to go we can try to read the memory
from the address provided by the client and so what we need here is the address
the address is appointed to avoid or something.
That will be our address.
Let's use the function str to I 64 that function allows us to also
specify a base for conversions that to be very convenient.
So r V two is our value as a string and then the endpoint is going to be
now also just look for the null terminator and and then the base is going
to be 16 so we'll get some kind of address.
This returns a long long let's just cast that forcefully to
appoint to avoid to make it easier for our next API call
assuming we have proper values here,
we are ready to call the rate process memory function so we have the handle to
the process we have the address we would like to read that would be address
that would be the address in the target process.
Then we have to provide our own buffer to store the incoming data.
So let's just read 64 bytes as an example here.
That's going to be data here and the number of bytes would like to
read that would be size of data and the last parameter indicates
how many bytes were actually read.
I'm going to specify now indicating I don't really care
if this fails for whatever reason.
Again we're going to have to display that error.
This could fail.
For example,
if the address is bogus and doesn't really have anything or
maybe the page protection is inappropriate.
So let's just display whatever we get is the error
from get last error and that's it.
Well almost that's it.
We have to probably display the data in some way otherwise would be very boring
because we wouldn't be able to see what's going on there.
Let's just write a very simple um look here to display the values.
What we're going to do here is if I% 16 equals 15 we
want to move to the next line.
Just do something like this.
We're going to display the actual item so we have percent X here and
and the space and just display whatever we have in that bite we have
data at index I something like this.
This should be good enough for our purposes.
Just display the 64 values there and that's it.
The I% 16 means that moderate 16 happens to be 15 after we have already
printed 16 values and then we can move to the next line to make things
look pretty from an output perspective.
Let's try this out first we compile that and then I'm going to open
that in the terminal so there's a terminal Visual Studio now but of
course you can also open that in an external command window or use
the debugger even So we need to go to X- 64 and debug where the
executable is, here's where our memory is,
we want to use that.
So if we just do that we get the helper text but we
actually want to try that out.
So let's grab VM app and find some appropriate process to look at.
And again,
Explorer is just a good option because it has lots of memory we can examine.
So let's look at the images first just as an example and let's grab some address
here like this one there's something here like the header,
it has the address.
F 08 and five zeros.
Well it's a bit of a mouthful.
Let's see if we can copy that.
Can we copy that copy address.
Okay,
let's see if that does what we hope so we have memories
again and then we have the process I.
D.
Which we have to specify that.
1332.
And then the address itself, let's paste it here goes let's remove the zero X.
I'm not sure the API is expecting that.
And let's see what we get so we get some values as we expect.
This works as expected.
And by the way you can see here the MZ signature for API
because we looked at the header of the piece so we do see
something let's try something else.
Let's try a different address.
Let's go with an address that doesn't really exist so nothing beyond that.
Let's go to total here.
So the address let's say something with eight and zeros shouldn't really exist.
So let's do something like this.
Do we have something here?
Probably not.
And we get an error with the value 299.
If we go to air look up just to make sure what that actually is here is 299
and so repressed memory didn't really work as expected.
Didn't really read anything concretely here because there was nothing there.
And so that works as well now if we try some other process
that might be perhaps more protected.
Let's go with selective process and launch things
with administrative privileges.
So let's try something that is more powerful like
Elsa's let's see if we can grab that.
So here's Elsa's um let's grab some address here.
Some private data or whatever.
It doesn't really matter.
Let's just copy the address and go back here and try this again.
Just the process AD 032.
Here's the address.
Let's remove the zero X.
And we get the access denied code ever opening the
process five is access denied indicating.
We just can't get a powerful enough handle.
Of course we can mitigate that by running this application itself.
Men read with the mean privileges that would allow
us to get the appropriate access.
But at least from this perspective we can't do that unless we have
administrative privileges in some cases won't be able to do that at
all when protected processes are in question.
And by the way of course we don't have to look at images.
We can use any kind of data here anywhere and see what's in
there if we have enough power to do so