Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

How to change a value in memory space of another process

If you could help me with this dilemma I have. Now, I know C \ C++, I know asm, I know about dll injection, I know about virtual memory addressing, but I just can't figure out how software like CheatEngine, and others, manage to change a variable's value in another process.

For those who don't know, 3rd party cheat engine tools can scan for values in the memory space of a program and identify the location of a variable with a given value and change it.

My question is, how do they do it?

Given an address, if I were to write C code, how could I change the value at that address belonging to another process without getting an invalid addressing error?

Thanks.

like image 654
florin.bunau Avatar asked Jun 06 '09 16:06

florin.bunau


2 Answers

I'm fairly certain those programs are pretending to be debuggers. On Windows, I would start with DebugActiveProcess() and go from there.

Oh, and the very useful looking ReadProcessMemory() function (and WriteProcessMemory()).

like image 182
i_am_jorf Avatar answered Sep 26 '22 02:09

i_am_jorf


On unix: ptrace()

like image 45
Thomas Avatar answered Sep 22 '22 02:09

Thomas