0

I've have tried to make a function that reads process memory in another process.
I have made a function that writes memory which works perfectly, but when i run the function ReadProcessMemory it comes with the error: "Access Violation".

The weird thing is it works fine when I do it in C++.
I think I remember something about EnableDebugPriv(), but in C++ it works fine without it.

ReadMemory: ; int ReadMemory(char *WindowName[], int address)
[ReadMemoryDataBuffer: DD 0]
[ReadMemoryReadData: DD 0]
    push ebp
    mov ebp, esp
        push DWORD[ebp + 8]
        push 0
        call 'USER32.FindWindowA'

        push ReadMemoryDataBuffer
        push eax
        call 'USER32.GetWindowThreadProcessId'

        push DWORD[ReadMemoryDataBuffer]
        push 1
        push 01F0FFF    ; ALL ACCESS
        call 'KERNEL32.OpenProcess'
        
        push DWORD[ReadMemoryDataBuffer]; extra
        push 4                          ; number of bytes to read
        push ReadMemoryReadData         ; pointer to read to
        push DWORD[ebp + 12]            ; address
        push eax                        ; Process
        call 'KERNEL32.ReadProcessMemory'
        
        mov eax, DWORD[ReadMemoryReadData]
    mov esp, ebp
    pop ebp
ret 8

Thanks in advance :)

1
Contributor
1
Reply
2
Views
7 Years
Discussion Span
Last Post by Icemens
0

Nevermind, it was a little bug in the code. (line 19)

ReadMemory: ; int ReadMemory(char *WindowName[], int address)
[ReadMemoryDataBuffer: DD 0]
[ReadMemoryReadData: DD 0]
    push ebp
    mov ebp, esp
        push DWORD[ebp + 8]
        push 0
        call 'USER32.FindWindowA'

        push ReadMemoryDataBuffer
        push eax
        call 'USER32.GetWindowThreadProcessId'

        push DWORD[ReadMemoryDataBuffer]
        push 1
        push 01F0FFF    ; ALL ACCESS
        call 'KERNEL32.OpenProcess'
        
        push ReadMemoryDataBuffer; extra
        push 4                          ; number of bytes to read
        push ReadMemoryReadData         ; pointer to read to
        push DWORD[ebp + 12]            ; address
        push eax                        ; Process
        call 'KERNEL32.ReadProcessMemory'
        
        mov eax, DWORD[ReadMemoryReadData]
    mov esp, ebp
    pop ebp
ret 8
This topic has been dead for over six months. Start a new discussion instead.
Have something to contribute to this discussion? Please be thoughtful, detailed and courteous, and be sure to adhere to our posting rules.