WriteProcessMemory not working for me...
lazarus / 23-Operating Systems

----------------------------------------------------------------------
CodeSculptor · 2022-07-16 15:36

My WRITEPROCESSMEMORY call is consistently not writing anything, and
the Bytes Written returned is consistently ZERO..

Here's the code I am using to prepare for the calls :

Get the Process ID as :
      Main_Process_ID : Cardinal;
      Main_Process_ID := Get_ProcessID( Trim( UpperCase(
lbProcesses.GetSelectedText )));

Set up the read/write area as :

VAR Heap_Byte_Address : Pointer;
       tmpByte_Array     : ARRAY [ 00 .. 128 ] OF BYTE;

Heap byte address was fetched from corresponding
ModuleInfo.lpBaseOfDll...
So the READS work great.

This works ok. (even when I read the entire heap... but only trying
two bytes here )

PROCEDURE intReadBuffer_From_Memory;
    VAR HowManyBytesRead : QWord;
        Process_Handle   : HANDLE;
       
    BEGIN
         Process_Handle := OpenProcess( PROCESS_ALL_ACCESS, False,
Main_Process_ID );

         ReadProcessMemory( Process_Handle,
                            Pointer( Heap_Byte_Address ),
                            @tmpByte_Array,
                            2,
                            HowManyBytesRead );
        
         CloseHandle( Process_Handle );
    END;
   

Here is how I prepare the assigning for Write (two bytes only)...
       tmpByte_Array[ 0 ] := 65;
       tmpByte_Array[ 1 ] := 65;
       WB_Size                 := 2;

Then I call with  WriteBufferToMemory( Heap_Byte_Address );   
 (below)...


Here's the call that fails :

    PROCEDURE WriteBufferToMemory( inAddress : Pointer );
    VAR HowManyBytesWritten : QWord;
        Process_Handle      : HANDLE;
       
    BEGIN                                 
         HowManyBytesWritten := 0;
         Process_Handle := OpenProcess( PROCESS_ALL_ACCESS, False,
Main_Process_ID );

         WriteProcessMemory( Process_Handle, 
                             Pointer( Heap_Byte_Address ),
                             @tmpByte_Array,
                             2, 
                             HowManyBytesWritten );
        
         CloseHandle( Process_Handle );
    END;

It's the WriteProcessMemory that fails.  Keeps showing 0 bytes
written, and returns the original bytes again when I call the read
again.

Any ideas?

----------------------------------------------------------------------
Thaddy · 2022-07-16 16:11

So you have an array of 129 bytes? Are you sure that is what you mean?
Shouldn't it be [0..127]?
Code: Pascal  [Select][+][-]window.onload = function(){var x1 =
document.getElementById("main_content_section"); if (x1) { var x =
document.getElementsByClassName("geshi");for (var i = 0; i
 tmpByte_Array     : packed array [ 0 .. 127 ] of byte;// packed
because of alignment, 128 bytes longI suspect, but did not test, that
your code is over-indexing. In {$R+} state the compiler will warn you
about that.

----------------------------------------------------------------------
Martin_fr · 2022-07-16 16:45

You didn't even tell what LastError reports....

----------------------------------------------------------------------
440bx · 2022-07-16 17:02

Code: Pascal  [Select][+][-]window.onload = function(){var x1 =
document.getElementById("main_content_section"); if (x1) { var x =
document.getElementsByClassName("geshi");for (var i = 0; i
Process_Handle := OpenProcess( PROCESS_ALL_ACCESS, False,
Main_Process_ID ); The first thing to do is to check that OpenProcess
succeeded, _particularly_ when you're asking for PROCESS_ALL_ACCESS.

Start there and, as Martin_fr suggested, when something fails, get the
last error from the O/S, otherwise you're programming blind.

ETA:

formatting suggestion, put your code between tags [ code = pascal ]
<your code> [ /code ]  (without the spaces after/before the brackets)

----------------------------------------------------------------------
CodeSculptor · 2022-07-16 17:05

I'd totally forgotten about Last Error..
it returns 998 .

Seems I MIGHT need : VirtualProtectEx'ing

----------------------------------------------------------------------
440bx · 2022-07-16 17:08

Did you first check that OpenProcess was successful ?

----------------------------------------------------------------------
CodeSculptor · 2022-07-17 00:47

To answer questions, YES, I did check to see that the process was
open.

And the biggest clue was Martin_fr's comment regarding :
"LastError"...

The 998 showed it was lack of permission to mod memory..

So the NEW write is now working as (oldSettings is : DWORD ) :

VirtualProtectEx( Process_Handle,
                           Pointer( Heap_Byte_Address ),
                           2,
                           PAGE_EXECUTE_READWRITE,
                           @oldSettings );

        
        
         WriteProcessMemory( Process_Handle, 
                                               Pointer(
Heap_Byte_Address ),
                             @tmpByte_Array,
                             2, 
                             HowManyBytesWritten );

         VirtualProtectEx( Process_Handle,
                           Pointer( Heap_Byte_Address ),
                           2,
                           oldSettings,
                           @oldSettings);                



Thanks everyone