Cheat Engine

Hatschi

VirtualAllocEx fails with "Access denied" Win32exception when I pass a 64bit address. Works fine when passing 32bit and also without passing an address at all.

Dark Byte · Posted: Wed May 27, 2015 3:24 am Post subject:

is the target process also compiled as 64 bit? And it's not running in a compat mode resulting all allocs to stay below 0xffffffff (there actually is such pe flag)

is lpAddress dividable by 0x10000 (65536)?

edit:i don't know vb, but why New IntPtr(Address) and not just Address? The address is not a call by reference

Hatschi · Posted: Wed May 27, 2015 4:24 am Post subject:

The target process is course 64bit. I've tried with multiple 64 bit games but it always failed.

Yes the address is dividable by 0x10000. For example when I pass 0x80000000 it fails.

Because the win api declaration requires a IntPtr as type. And the variable Address is a type long. By using New IntPtr(Address) I declare a new variable of type IntPtr with that value.
https://msdn.microsoft.com/en-us/library/system.intptr%28v=vs.110%29.aspx?cs-save-lang=1&cs-lang=vb#code-snippet-1

//edit: Interesting. The MSDN says: "If the value of the lpAddress parameter is NULL, specifying MEM_COMMIT without MEM_RESERVE causes the function to BOTH reserve and commit the memory" so I changed the allocationflag to be MEM_RESERVE and now I got the error code 487 instead of 5.

atom0s · Posted: Wed May 27, 2015 7:35 am Post subject:

Check this and see if it helps:
https://msdn.microsoft.com/en-us/library/windows/desktop/aa366720(v=vs.85).aspx

Hatschi · Posted: Thu Jun 04, 2015 12:12 pm Post subject:

That's virtualalloc but not virtualallocex.

//edit: Is there ANY way to prevent the process overwriting injected code without setting the protection to no acess (it should still be execute/read/write).

I've epxerienced that when searching for free memory and writing my code to that area. Some games overwrite the code when they create new code on their own.

atom0s · Posted: Fri Jun 05, 2015 12:14 am Post subject:

Hatschi · Posted: Fri Jun 05, 2015 2:58 am Post subject:

But how does VirtualAllocEx work? Because regions created with virtualallocex never gets overwritten.

But when I search for empty space on my own and write my bytes into this area there is a slightly chance that its get overwritten.

Isn't there a way to do exactly what virtualallocex does but manually?

atom0s · Posted: Fri Jun 05, 2015 2:22 pm Post subject:

Hatschi · Posted: Fri Jun 05, 2015 2:29 pm Post subject:

I'm sorry you misunderstood me. I wanted to know how the winapi VirtualAllocEx works and if there is a way to do EXACTLY the same this API does but manually?

Can I commit a memory region in another process without using virtualallocex?

Stylo · Posted: Sat Jun 06, 2015 10:43 am Post subject:

Yes, by calling ZwAllocateVirtualMemory (the troll answer).
now, VirtualAlloc eventually requesting from kernel to allocate memory for the current process, so you cannot manually allocate memory from user land.
and unfortunately, all memory allocations go through ZwAllocateVirtualMemory in user mode of course.

Hatschi · Posted: Sat Jun 06, 2015 11:26 am Post subject:

I guessed so. But thanks for your answer