C# ReadProcessMemory and WriteProcessMemory

[C#] ReadProcessMemory and WriteProcessMemory - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Tech (https://hackforums.net/forumdisplay.php?fid=444)
+--- Forum: Coding (https://hackforums.net/forumdisplay.php?fid=151)
+---- Forum: Software Development (https://hackforums.net/forumdisplay.php?fid=118)
+---- Thread: [C#] ReadProcessMemory and WriteProcessMemory (/showthread.php?tid=6016491)

Pages: Pages 1 2

RE: ReadProcessMemory and WriteProcessMemory - ProtectedOverride - Oct 16, 2019

in my scenario I do want the task manager to reflect the change :) Anyway I have a way around that. If I can get it working on 64bit I have a workable solution. Tried with "AnyCPU" compiling, no luck, fails to write back change as before. When you say need 64 bit address, what part of the code is 32 bit specific?

Thanks

RE: ReadProcessMemory and WriteProcessMemory - Paskowsky - Oct 16, 2019

(Oct 16, 2019 12:02 PM)ProtectedOverride Wrote: in my scenario I do want the task manager to reflect the change :) Anyway I have a way around that. If I can get it working on 64bit I have a workable solution. Tried with "AnyCPU" compiling, no luck, fails to write back change as before. When you say need 64 bit address, what part of the code is 32 bit specific?

Thanks

What changes from x86 to x64 is offsets from PEB base address since different data types are used and so IntPtr size is 8 instead of 4

like here :

Code 
if (!ReadProcessMemory(hProcess, peb + 0x10, (IntPtr)(&rtlUserProcParamsAddress), Marshal.SizeOf(typeof(IntPtr)), out intOutput))

Take a look at this website : https://www.geoffchappell.com/studies/windows/win32/ntdll/structs/peb/index.htm

peb + 0x10 would become peb + 0x20

Regards,
Paskowsky 🤝

RE: ReadProcessMemory and WriteProcessMemory - ProtectedOverride - Oct 16, 2019

(Oct 16, 2019 12:44 PM)Paskowsky Wrote: What changes from x86 to x64 is offsets from PEB base address since different data types are used and so IntPtr size is 8 instead of 4

like here :

Code
if (!ReadProcessMemory(hProcess, peb + 0x10, (IntPtr)(&rtlUserProcParamsAddress), Marshal.SizeOf(typeof(IntPtr)), out intOutput))

Take a look at this website : https://www.geoffchappell.com/studies/windows/win32/ntdll/structs/peb/index.htm

peb + 0x10 would become peb + 0x20

Regards,
Paskowsky 🤝

Thank you @Paskowsky, this has helped a lot, made some progress but having trouble allocting memory in 64bit process, presumably I need to change this:

/* allocate memory for Input /
Current_ImageBase.Length = (ushort)(input.Length 2);
pNewAddr = VirtualAllocEx(hProcess, IntPtr.Zero, Current_ImageBase.Length, /* AllocationType.Commit / 0x1000 | / AllocationType.Reserve / 0x2000, / MemoryProtection.ExecuteReadWrite */ 0x40);
if (pNewAddr == IntPtr.Zero)
{
Console.WriteLine("ERROR: Could not allocate memory in target process.\n");
return false;
}

RE: ReadProcessMemory and WriteProcessMemory - Paskowsky - Oct 16, 2019

(Oct 16, 2019 02:52 PM)ProtectedOverride Wrote: Thank you @Paskowsky, this has helped a lot, made some progress but having trouble allocting memory in 64bit process, presumably I need to change this:

/* allocate memory for Input /
Current_ImageBase.Length = (ushort)(input.Length 2);
pNewAddr = VirtualAllocEx(hProcess, IntPtr.Zero, Current_ImageBase.Length, /* AllocationType.Commit / 0x1000 | / AllocationType.Reserve / 0x2000, / MemoryProtection.ExecuteReadWrite */ 0x40);
if (pNewAddr == IntPtr.Zero)
{
Console.WriteLine("_error_: Could not allocate memory in target process.\n");
return false;
}

[code]
throw new Win32Exception(Marshal.GetLastWin32Error());
[code]

inside the if, it will show what error you are getting from windows.

RE: ReadProcessMemory and WriteProcessMemory - SKIDROOTKIT - Oct 18, 2019

(Oct 16, 2019 02:52 PM)ProtectedOverride Wrote: Thank you @Paskowsky, this has helped a lot, made some progress but having trouble allocting memory in 64bit process, presumably I need to change this:

/* allocate memory for Input /
Current_ImageBase.Length = (ushort)(input.Length 2);
pNewAddr = VirtualAllocEx(hProcess, IntPtr.Zero, Current_ImageBase.Length, /* AllocationType.Commit / 0x1000 | / AllocationType.Reserve / 0x2000, / MemoryProtection.ExecuteReadWrite */ 0x40);
if (pNewAddr == IntPtr.Zero)
{
Console.WriteLine("_error_: Could not allocate memory in target process.\n");
return false;
}

Are both your own process & the remote process running as the same architecture? (64 bit, not wow64)
Does hProcess have the PROCESS_VM_OPERATION process access right?

RE: ReadProcessMemory and WriteProcessMemory - ProtectedOverride - Oct 19, 2019

My issue was i had changed the memory protection setting on VirtualAllocEx. I made some progress in that CommandLine was being blanked. Away for a couple of days but ill do some more testing when I get back to see if I can figure what I might have missed.

RE: ReadProcessMemory and WriteProcessMemory - ProtectedOverride - Oct 21, 2019

Thanks for all the help, got this working, my final problem was I was using 0x78 rather then 0x70. Updated this and got it working on x64 :)