Menu
I am thinking about a problem I have been having for some time now.. I would like to write a C/C++ program (under windows first) that can access(read/change values) the memory(stack, heap, everything) of other running programs. (Not like shared memory but any memory the computer has..) Without having to start the application from my own application.. I have seen something like this before but I just can't figure out how it's done.. If I were to access the memory of any running program I would get errors from the OS right? Any help is appreciated!
733
Memory access syntax in C Because C is a system programming language, it must provide direct access to physical hardware, including memory. The above C code uses square brackets to access memory cell #248, counting from the beginning of memory. This code would compile just fine on PDP-7.
Unless the program is specifically built to be able to inject itself in another processes memory space (i.e. using specific Windows programming calls that need administrative access), a program cannot see another programs memory.
Processes cannot access other processes' memory in principle. In practice the underlying operating system usually offers this mechanism to privileged processes.
In C, the library function malloc is used to allocate a block of memory on the heap. The program accesses this block of memory via a pointer that malloc returns. When the memory is no longer needed, the pointer is passed to free which deallocates the memory so that it can be used for other purposes.
As @sharptooth said, this requires support from the OS. Different OS does it differently. Since you are on Windows, there are a few steps you could follow:
OpenProcess, or CreateProcess to access, or launch a new process. In this call, you must request PROCESS_VM_READ access.ReadProcessMemory to read a chunk of memory in that opened process.If you want to change memory of another process, you then need PROCESS_VM_WRITE access and use WriteProcessMemory to achieve that.
In Linux, for example, you'd use ptrace to attach to a process and peek, poke its memory.
93
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With
