CODEWITHSUNDEEP
cvisual-c++
Dean
Dean

Reputation: 517

read memory from pointer

I have a function like this:

int __stdcall sub_57BBD0(int a1, int a2, int a3, char a4)
{
  *(_BYTE *)a3 = *(_BYTE *)a1;
}

*(BYTE*)(a1 + 0) is a pointer to a BYTE*

from the pointer of a1, how can I get the BYTES data that this that pointer points to? or is it impossible?, Because a1 points to a BYTE* in memory, I can ReadProcessMemory to get the data, but can I do it another way?

I've tried doing:

BYTE *data = *(BYTE*)&a1;

but it's not working,

Am I missing something here?

Upvotes: 1

Views: 2391

Answers (2)

paddy
paddy

Reputation: 63471

Mmmm, this code looks pretty dirty. Is it a disassembly or something?

Anyway, the value a1 seems to be a pointer that is used as an int. You have this:

*(_BYTE *)a3 = *(_BYTE *)a1;

That is taking the first _BYTE value from the memory location that a1 points to and storing it in the memory location that a3 points to.

If you want to get the pointer itself, then just don't dereference it:

BYTE *data = (BYTE*)a1;

All you are doing here is type-casting from an integer to a BYTE* (which I assume is the same as _BYTE).

Now you can reference BYTE values from data as if it was an array (assuming that the memory is actually allocated to your process):

BYTE secondVal = data[1];

And so on...

Upvotes: 3

TimoteeTheCodeMonkee
TimoteeTheCodeMonkee

Reputation: 332

BYTE * data = *(BYTE*)&a1;

This line says, get the address of the integer, a1, cast it to a BYTE pointer, dereference it and get the value of it, and then assign that to a BYTE pointer called data.

So you'll want to do this instead:

BYTE data = *((BYTE *)&a1);

Upvotes: 0

Related Questions