CODEWITHSUNDEEP
c++pointersmemorymemory-address
llk
llk

Reputation: 2561

Accessing direct memory addresses and obtaining the values in C++

I was wondering if it was possible to access a direct block of memory using C/C++ and grab the value. For example:

int i = 15;
int *p = &i;
cout << &i;

If I took the printed value here, that would give me the address of the variable i, which contains the value 15. I will just say it printed out 0x0ff9c1 for this example. If I have a separate program which declares a pointer like so...

int *p = 0x0ff9c1;
cout << *p;

Would it be possible to print out that 15 that the other application placed in the memory block 0x0ff9c1? I know my pointer declaration with the memory address is incorrect, I am unsure how to do it otherwise. I have tried using memcopy but I have not been able to get that to work either. I know this is possible somehow as I have a program called Cheat Engine which modifies game memory address values to gain unfair advantages. I have been successful in placing the printed memory location and obtaining the value (15) though Cheat Engine. My goal is to do this using C++. If this is too confusing, basically I would like to access a variable that another application stored using its memory address and print out the value. I am using Windows 7 x64 with MinGW compiler if that matters. Thanks!

PS: I'll post a picture of what Cheat Engine does to give a better idea. enter image description here

Upvotes: 17

Views: 20858

Answers (5)

user3771655
user3771655

Reputation: 185

A bit late, but you still could this through a DLL injection. Here is a link to a tutorial: http://resources.infosecinstitute.com/using-createremotethread-for-dll-injection-on-windows/

Upvotes: 0

Eran
Eran

Reputation: 22020

If you want to change the memory used by another process, one way would be to inject your code into the other process. From that point, you can do whatever you want to the other program's memory as if it were your owns.

Search around for remote thread creation or hooking. There are more than a few questions about it here (and here, for starters).

Upvotes: 3

HostileFork says dont trust SE
HostileFork says dont trust SE

Reputation: 33607

You can't do it in a platform-agnostic way in C++. While I haven't used this "cheat engine" specifically, it almost certainly is using the same special API that a debugger uses. The code will be specific to Windows, and you will require a certain privilege level on the running process.

(For instance, if you are using Visual Studio and execute a program from it in a Debug Mode, Visual Studio can look at and modify values in that program.)

I haven't written a debugger in a while, so I don't know where a good place to get started on the Debug API is, but you can search around the web for things like this article:

http://www.woodmann.com/fravia/iceman1.htm

Upvotes: 5

Lee-Man
Lee-Man

Reputation: 414

In general, it's not usually possible for one program to modify the memory of another. The system goes to great lengths to ensure this. If it did not, no program would be safe. This is particularly true in all the Unix variants I've worked on, though not on all proprietary OSes I've seen.

Note that none of these rules apply to the kernel ...

There is also a programming paradigm called shared memory, but you have to explicitly set that up.

Short answer: you can't usually do that. I believe you mentioned windows. I know nothing about Windows, so your mileage may vary.

Upvotes: 1

Ed Heal
Ed Heal

Reputation: 59997

The two processes have separate address spaces. One process cannot access another processses memory unless it is explicily shared memory.

Upvotes: 5

Related Questions