+- Hack Forums (https://hackforums.net)
+-- Forum: Tech (https://hackforums.net/forumdisplay.php?fid=444)
+--- Forum: Coding (https://hackforums.net/forumdisplay.php?fid=151)
+---- Forum: Software Development (https://hackforums.net/forumdisplay.php?fid=118)
+---- Thread: [C#] ReadProcessMemory and WriteProcessMemory (/showthread.php?tid=6016491)
Pages: Pages
1
2
ReadProcessMemory and WriteProcessMemory - ProtectedOverride - Oct 15, 2019
Hi,
I have been playing around reading and writing to the PEB of an external process using ReadProcessMemory and WriteProcessMemory which is part of kernel32.dll. Whilst I am able to read values, such as CommandLine, I do not seem to be able to then change this by using WriteProcessMemory. Does anyone have an example of this that would help me do this?
Thanks
James
RE: ReadProcessMemory and WriteProcessMemory - HFDone - Oct 15, 2019
you need to use unicode string
RE: ReadProcessMemory and WriteProcessMemory - ProtectedOverride - Oct 15, 2019
This is what I am trying:
byte[] dataBuffer = Encoding.Unicode.GetBytes("NEW STRING");
IntPtr bytesWritten = IntPtr.Zero;
int cnt = 0;
WriteProcessMemory(handle, us.Buffer, dataBuffer, dataBuffer.Length, ref cnt)
RE: ReadProcessMemory and WriteProcessMemory - HFDone - Oct 15, 2019
search for peb patch and see how its done
RE: ReadProcessMemory and WriteProcessMemory - GraeskMytologi - Oct 15, 2019
(Oct 15, 2019 03:49 AM)ProtectedOverride Wrote: Hi,
I have been playing around reading and writing to the PEB of an external process using ReadProcessMemory and WriteProcessMemory which is part of kernel32.dll. Whilst I am able to read values, such as CommandLine, I do not seem to be able to then change this by using WriteProcessMemory. Does anyone have an example of this that would help me do this?
Thanks
James
You need to change the protection level with VirtualProtectEx
RE: ReadProcessMemory and WriteProcessMemory - Paskowsky - Oct 15, 2019
(Oct 15, 2019 03:49 AM)ProtectedOverride Wrote: Hi,
I have been playing around reading and writing to the PEB of an external process using ReadProcessMemory and WriteProcessMemory which is part of kernel32.dll. Whilst I am able to read values, such as CommandLine, I do not seem to be able to then change this by using WriteProcessMemory. Does anyone have an example of this that would help me do this?
Thanks
James
What error WriteProcessMemory shows you?
If i remeber correctly in PEB strings are stored as UNICODE_STRING
Code
typedef struct _UNICODE_STRING {
USHORT Length;
USHORT MaximumLength;
WCHAR *Buffer;
} UNICODE_STRING, PUNICODE_STRING;Regards,
Paskowsky
RE: ReadProcessMemory and WriteProcessMemory - Skofos - Oct 16, 2019
always using @Amaa game trainer. WriteProcessMemory and ReadProcessMemory : GitHub - ama6nen/project-autism: Project-autism (old growtopia trainer) 2017 source code
RE: ReadProcessMemory and WriteProcessMemory - ProtectedOverride - Oct 16, 2019
@HFDone I tried the example back from 2011:
pastebin dot com/8mujr2ps
However I find I am taking this path:
if (!WriteProcessMemory(hProcess, rtlUserProcParamsAddress + 0x70, (IntPtr)(&Current_ImageBase), Marshal.SizeOf(typeof(UNICODE_STRING)), out intPtrOutput))
{
Console.WriteLine("ERROR: Failed to reflect change back to PEB.\n");
return false;
}
Could this be that the code has some "32Bit" specifics that need changing for working with 64Bit? I have not worked at this low of a level when programming before so just trying to understand.
Thanks
James
Further update, I had a play with someone else implementation:
pastebin dot com/Z9hdggtM
However this part:
status = NtProtectVirtualMemory(hProc, ref lpRemoteCommandLine, ref dwSizeUnicodeString, 0x04 /* read, write */, ref dwOldProtections);
Causes the applicaiton to exit with an "Access Violation"..Is this just .NET doing something I can bypass?
RE: ReadProcessMemory and WriteProcessMemory - HFDone - Oct 16, 2019
are you using v2 using System; using System.Linq; using System.Collections.Generic; using Syst - Pastebin.com
you should enable safe code in vs to use it
you have wrong value in the second param should be + 0x40
Current_ImageBase.buffer = pNewAddr;
if (!WriteProcessMemory(hProcess, rtlUserProcParamsAddress + 0x40, (IntPtr)(&Current_ImageBase), Marshal.SizeOf(typeof(UNICODE_STRING)), out intPtrOutput)) {
Console.WriteLine("ERROR: Failed to reflect change back to PEB.\n");
return false;
}
RE: ReadProcessMemory and WriteProcessMemory - ProtectedOverride - Oct 16, 2019
is that the "Allow unsafe code: enabled" in Build properties? I have that ticked. Tried with 0x70 , as I noted 0x40 was for windows title..oops but getting the same error, the bool returns false when using this example... hmmm
RE: ReadProcessMemory and WriteProcessMemory - HFDone - Oct 16, 2019
create new project c&p the pastebin code run notepad and try it
RE: ReadProcessMemory and WriteProcessMemory - ProtectedOverride - Oct 16, 2019
ok so, if I comiple as x64 and run it against an x64 process this is when I get the above error. If I compile as x32 and run against x32 process I get no error. However I do not see the change reflected in Task Manager under "Command Line". I do close and reopen to get it to refresh it's values. Any ideas?
Update:
It seems it is working for 32Bit against 32Bit when I check in process explorer but Task manager does not reflect the change, any ideas if I can mitigate this? Regarding the 64Bit problem I am guessing I need to look at the variable types used maybe?
RE: ReadProcessMemory and WriteProcessMemory - HFDone - Oct 16, 2019
the patch is in memory and probably the task get the cmd from the file
for 64 bit you need 64 bit address or you can use anycpu option to work with both
RE: ReadProcessMemory and WriteProcessMemory - ProtectedOverride - Oct 16, 2019
but the command is only in memory? Lets sya I execute SomeProcess.exe -t SuperSecretArgument ... Are you saying I can not "overwrite" the "SuperSecretArgument" from task manager?
Thanks!
RE: ReadProcessMemory and WriteProcessMemory - HFDone - Oct 16, 2019
task just show you the process info
anyway you dont really want the task show you change it