C programming: Write a memory scanner (part 1 of 8)
Why Stack Overflow recommends it
Stack Overflow users link it when they are building process memory scanners and want a worked example of the Windows VirtualQueryEx and ReadProcessMemory approach.
Recommended by 0 people across 0 different months, 2012 to 2021.
What it is
The first of eight short tutorials in which gimmeamilk writes a simple memory scanner in C from scratch. The scanner searches another running program's memory to find where a value such as a game's lives counter is stored. This part covers the starting concepts and code for the project.
What people said
Cites Alex · 2012-09 · Stack Overflow · on “C++ VirtualQueryEx infinite loop”
I'm currently re-creating a memory modifier application using C++, the original was in C#. All credit goes to "gimmeamilk" who's tutorials Ive been following on [this video] . I would highly recommend these tutorials for anyone attempting to create a similar application. The problem I have is that my VirtualQueryEx seems to run forever. The process I'm scanning is "notepad.exe" and I am passing to the application via command line parameter. std::cout<<"Create scan started\n"; #define WRITABLE (PAGE_READWRITE | PAGE_WRITECOPY | PAGE_EXECUTE_READWRITE | PAGE_EXECUTE_WRITECOPY) //These are all the flags that will be used to determin if a memory block is writable. MEMBLOCK * mb_list = NULL; //pointer
Cites jwaliszko · 2014-01 · Stack Overflow · on “VirtualQueryEx alternative for Linux - how to get virtual memory range of another process”
I went through this blog [LINK] and this videocast [this video] . In Windows if I want to retrieve information about a range of pages within the virtual address space of a specified process, I can use WinAPI VirtualQueryEx method [LINK] : MEMORY_BASIC_INFORMATION meminfo; unsigned char *addr = 0; for(;;) { if(!VirtualQueryEx(hProc, addr, &meminfo, sizeof(meminfo))) break; if(meminfo.State & MEM_COMMIT) { //collect some data from meminfo } addr = (unsigned char*)meminfo.BaseAddress + meminfo.RegionSize; } I wondered how to get similar set of information in Linux using syscalls, but it is not clear for me how using C/C++ can I gather such a data under Linux. I went through this thread [LINK] when t
Cites Nikolai Savulkin · 2021-07 · Stack Overflow · on “inconsistent results when reading the memory of another process with winapi ReadProcessMemory”
So following on with my attempt at making a memory scanner in rust, I've stumbled upon some problems with the output of the reading script. It seems that sometimes the returned array of u8 is large and mostly zeroed out with some values here and there. It looks akin to the output from second episode of this tutorial series [this video] . Most frequently however it seems to find no memory at all, returning 0 from ReadProcessMemory with invalid handle error. Sometime however it does neither and keep on returning few small identical looking regions (always the same). Below is my script narrowed down to be very basic: use std::ffi::OsStr; use std::iter::once; use std::os::windows::ffi::OsStrExt; use