Cheat Engine Forum Index Cheat Engine
The Official Site of Cheat Engine
 
 FAQFAQ   SearchSearch   MemberlistMemberlist   UsergroupsUsergroups   RegisterRegister 
 ProfileProfile   Log in to check your private messagesLog in to check your private messages   Log inLog in 


[C#] ReadProcessMemory like CE do

 
Post new topic   Reply to topic    Cheat Engine Forum Index -> General programming
View previous topic :: View next topic  
Author Message
ronjaraeubertochter
How do I cheat?
Reputation: 0

Joined: 11 Aug 2017
Posts: 3

PostPosted: Fri Aug 11, 2017 11:44 am    Post subject: [C#] ReadProcessMemory like CE do Reply with quote

Hey guys,

I want to read the memory of a external process using C#.

The ReadProcessMemory-method from kernel32.dll seems to not allow to read the protected memory (always returns zeros while reading protected memory).

I have read that I can use the dbk32.sys to create a dbk32.dll to read the process memory like CE do. But I have no idea how to create and include this dll Sad
Back to top
View user's profile Send private message
JohnnyBF
How do I cheat?
Reputation: 0

Joined: 11 Aug 2017
Posts: 3

PostPosted: Fri Aug 11, 2017 12:31 pm    Post subject: Reply with quote

Try VAMemory class (i cant post urls ;/ google it)
Back to top
View user's profile Send private message
ronjaraeubertochter
How do I cheat?
Reputation: 0

Joined: 11 Aug 2017
Posts: 3

PostPosted: Fri Aug 11, 2017 1:46 pm    Post subject: Reply with quote

thank you for your help so far Smile

But I see 2 problems with vamemory:
1st) I can't open a process with its pid (only by name which is not unique all the time)
2nd) It looks like that vamemory is using the same standard api so I would not have read-access to protected memory
Back to top
View user's profile Send private message
atom0s
Moderator
Reputation: 137

Joined: 25 Jan 2006
Posts: 7286
Location: 127.0.0.1

PostPosted: Mon Aug 14, 2017 1:52 am    Post subject: Reply with quote

Try using VirtualProtectEx to adjust the protections of the memory you are trying to read if it does not have proper access. Otherwise, you are going to have to either code a driver, which is what dbk32.sys is or inject into the process and read the memory locally.
_________________
- Retired.
Back to top
View user's profile Send private message Visit poster's website
ronjaraeubertochter
How do I cheat?
Reputation: 0

Joined: 11 Aug 2017
Posts: 3

PostPosted: Tue Aug 15, 2017 8:36 am    Post subject: Reply with quote

atom0s wrote:
Try using VirtualProtectEx to adjust the protections of the memory you are trying to read if it does not have proper access.

I tried this but no changes happen:
Code:

int bytesRead = 0;
byte[] buffer = new byte[3000000];

uint oldProtect = 0;
uint PAGE_EXECUTE_READWRITE = 0x40;

VirtualProtectEx(processHandle, (IntPtr)0x5E57F000, (UIntPtr)buffer.Length, PAGE_EXECUTE_READWRITE, out oldProtect);
ReadProcessMemory((int)processHandle, 0x5E57F000, buffer, buffer.Length, ref bytesRead);

After reading, my buffer still contains only zeros (while reading protected memory - unprotected memory is working fine)

atom0s wrote:
Otherwise, you are going to have to either code a driver, which is what dbk32.sys is.

Few days ago I already tried to compile the "mykerneldriver.sln" from the CE-sources but it fails Sad
But I will try it today again....

atom0s wrote:
or inject into the process and read the memory locally.

Uff.. this sounds hard. Have you got some information for me to do this using c#?
Back to top
View user's profile Send private message
hollow87
Cheater
Reputation: 0

Joined: 07 Feb 2015
Posts: 28

PostPosted: Sun Sep 17, 2017 8:08 pm    Post subject: Reply with quote

DLL injection normally requires a native DLL (like from C/C++ etc)

If you wish to do it mostly from all C# you can try injecting a native bootstrap DLL into the target process and have that load the CLR runtime and execute a managed DLL in the new CLR runtime.
Back to top
View user's profile Send private message
Display posts from previous:   
Post new topic   Reply to topic    Cheat Engine Forum Index -> General programming All times are GMT - 6 Hours
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Powered by phpBB © 2001, 2005 phpBB Group

CE Wiki   IRC (#CEF)   Twitter
Third party websites