3

The title really says it all, I want to have all the readable memory of another process in a buffer. I understand that I will have to use ReadProcessMemory(), but If I'm correct I can't just use one call to ReadProcessMemory() starting from address 0 for example, because there would be addresses that are non readable in the range.

I have one idea, which I believe should work, I would like to know if this is an actual solution and if there are any better solutions.

My idea would be to start from address 0 and use VirtualQueryEx to check if the current range is readable, if yes I read it, and in both cases I jump forward the size of the range, and repeat until VirtualQueryEx returns that my address is too high.

Would this actually get all the memory? Is there a better/different method?

6
  • 1
    I’d really hope that Windows doesn’t allow you reading any memory from another process unless that process explicitly allows it.
    – gnasher729
    Mar 15, 2021 at 13:42
  • Right, I assume it probably doesn't, but in this case I can run as administrator if needed and I assume then it is possible.
    – DrWCTapir
    Mar 15, 2021 at 13:48
  • 1
    Reading the memory of another process is an essential part of having a debugger. How about QueryWorkingSetEx ?
    – pjc50
    Mar 15, 2021 at 14:04
  • Yes, that is how you do it.
    – user253751
    Mar 15, 2021 at 14:19
  • So If i understand correctly the solution would be to more or less switch VirtualQueryEx with QueryWorkingSetEx? If this is the case why does VirtualQueryEx not work?
    – DrWCTapir
    Mar 15, 2021 at 14:32

2 Answers 2

2

Yes, as you have surmised, you can start from address 0, use VirtualQueryEx to get information about that whole region of memory, including the start and end address of the region. Then you can go straight to the end of that region, which is the beginning of the next region, and use VirtualQueryEx to get information about that region. Repeat until you get to the end of the address space.

As you go along, you can use ReadProcessMemory to read the data. Note that there are many types of memory regions; only "committed" regions are actually associated with memory. Reading from uncommitted memory regions will fail.

13
  • Note to suggested editor: "surmise" is a real word.
    – user253751
    Mar 15, 2021 at 15:26
  • NOTE: you will have to ensure that your system has sufficient memory to accommodate the read result of memory (especially if you are trying to read memory of large size process like MS Sql Server) and avoid crash.
    – JPI
    Mar 15, 2021 at 16:01
  • This requires elevated privileges, right? Hopefully?
    – JimmyJames
    Mar 15, 2021 at 17:38
  • 1
    @JimmyJames I believe most desktop operating systems allow you to read from your own processes, because they're yours and you can do what you want with them.
    – user253751
    Mar 15, 2021 at 17:50
  • 1
    @user253751 I sincerely hope that's not still the case. Do you really want your e.g. browser extensions to be able to see what you are doing in every application you have open? When I saw this question, my first thought was that you were trying to create malware.
    – JimmyJames
    Mar 15, 2021 at 17:55
-2

What you are asking for is quite literally an affront to the very core principles of a modern operating system. The modern operating system, whether you are referring to *Nix or Windows, is built on the clear delineation of Kernel and User Space. The Kernel space is really the only place where such a thing would ever be allowed, as the Kernel has the sole responsibility to map the physical memory addresses of the hardware to the virtual memory address space that is allocated to individual processes. The memory allocation to the individual processes is bounded in the User space and is virtually mapped in such a way that you cannot reliably or explicitly refer to actual physical address locations.

This security feature is not only ingrained into the core functions of the kernel, but is also ingrained into the physical hardware of the CPU itself with codified machine instructions provided to ensure that user space is protected.

With all of that being said, if this is something you absolutely must be able to do, then your only options are to develop functionality into custom kernel modules (possible in *Nix systems, is it even possible in windows???), or you can in some circumstances implement shared memory regions between specific processes. If your goal is to debug a specific process though then I would look into specific tools like gdb for inspection of symbols and memory allocations that have been allocated. All of these things are too broad to specify in a single answer however.

3
  • 3
    But doesn't a debugger also have to have access to the process' memory?
    – DrWCTapir
    Mar 15, 2021 at 14:30
  • A debugger has weird permissions that ordinary applications don’t have.
    – gnasher729
    Mar 15, 2021 at 16:22
  • 2
    @gnasher729 not true in most cases - they're just normal user space programs, such as gdb and windbg.
    – pjc50
    Mar 16, 2021 at 14:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.