The MASM Forum Archive 2004 to 2012

General Forums => The Campus => Topic started by: ragdog on June 02, 2008, 02:40:31 PM

Title: ReadProcessMemory from dll
Post by: ragdog on June 02, 2008, 02:40:31 PM
hi

i have a question to ReadProcessMemory

it is possible a dll with ReadMemoryProcess read or write a dll from runnning process

have your a idea or soucecodes in masm32

greets
ragdog
Title: Re: ReadProcessMemory from dll
Post by: PBrennick on June 02, 2008, 04:38:44 PM
ragdog,
I know thta sometimes things get lost in the translation. You can't mean that you want to write to a DLL?!?

Paul
Title: Re: ReadProcessMemory from dll
Post by: ragdog on June 02, 2008, 06:19:45 PM
sorry

no i write no a dll !

i seach a example for ReadProcessMemory or  WriteProcessMemory in a dll
the dll is loaded from a another running process

raGDOG
Title: Re: ReadProcessMemory from dll
Post by: donkey on June 03, 2008, 09:27:54 AM
I have used ReadProcessMemory on occasion though not in a DLL and have wondered whether it is reliable when executed without suspending the process being read. I could not find any documentation on whether the API suspends execution of the target process while it reads so I assume it does not. This may lead to corrupt data due to reading addresses with only partially completed writes when your timeslice comes around. Anyway, it seems on the surface to have the potential to be unreliable except when debugging a process.
Title: Re: ReadProcessMemory from dll
Post by: slovach on June 04, 2008, 09:29:42 PM
Sure you can do it, but if you're injecting the DLL, you're in the processes memory space and can control it as you will, so it's kind of pointless.

You should just be able to do something like this if you're injected into it:

mov eax, dword ptr ds:[12345678h]


Otherwise, ReadProcessMemory would work just as expected.
Title: Re: ReadProcessMemory from dll
Post by: ragdog on June 04, 2008, 09:46:46 PM
thanks for your help


my problem is solved with getmodulbaseadress :bg

greets
ragdog