Return Styles: Pseud0ch, Terminal, Valhalla, NES, Geocities, Blue Moon.

Pages: 1-4041-

patching memory in another process

Name: Anonymous 2006-02-06 9:03

Hi /prog/

I am writing a program to patch a memory location in another running process. Unfortunately it doesn't work as ReadProcessMemory gets an error 6 ("The handle is invalid."), even though the process ID passed on the command line is valid.

Has anyone here done this sort of thing before, and if so d'you know what I may be doing wrong?

Code is below:

#define PATCH_LOCATION 0x0013A142

void error(char *msg)
{
    printf("Error (%s) [0x%08x]\n", msg, GetLastError());
    ExitProcess (0);
};

void main(int argc, char* argv[])
{
    int patch_int;
    HANDLE process_id;
    HANDLE hToken;

    // get process id from command line
    if (argc<2)
        error ("args");
    sscanf(argv[1],"%u",&process_id);
    printf("process_id = %u\n", process_id);

    // attach to process as debugger
    if (DebugActiveProcess((DWORD)process_id)==FALSE)
        error ("DebugActiveProcess()");

    // read patch location
    if (ReadProcessMemory(process_id, (LPVOID)PATCH_LOCATION, &patch_int, 4, NULL)==FALSE)
        error ("ReadProcessMemory()");

    printf("patch_int = 0x%08x\n", patch_int);

    // check if patch location contains expected value
    if (patch_int==250)
    {
        // if so, overwrite with patch value
        patch_int=0xFFFFFFFF;
        if(WriteProcessMemory (process_id, (LPVOID)PATCH_LOCATION, &patch_int, 4, NULL)==FALSE)
            error ("WriteProcessMemory()");
    }
    else
    {
        // or fail
        error("patch_int");
    }

    printf("success!\n");
};

Name: Anonymous 2006-02-06 9:45

You're probably mixing process IDs (PIDs), i.e. what GetCurrentProcessId returns, with process handles, i.e. what GetCurrentProcess returns.

Name: Anonymous 2006-02-06 10:27 (sage)

>>2

That was the problem, thanks for your help.

(Below is fixed code)

#define PATCH_LOCATION 0x0013A142

DWORD process_id;

void error(char *msg)
{
    printf("Error (%s) [0x%08x]\n", msg, GetLastError());
    DebugActiveProcessStop((DWORD)process_id);
    ExitProcess (0);
};

void main(int argc, char* argv[])
{
    int patch_int;
    HANDLE hProcess;
    HANDLE hToken;

    // get process id from command line
    if (argc<2)
        error ("args");
    sscanf(argv[1],"%u",&process_id);
    printf("process_id = %u\n", process_id);

    // attach to process as debugger
    if (DebugActiveProcess((DWORD)process_id)==FALSE)
        error ("DebugActiveProcess()");

    // get a process handle
    hProcess=OpenProcess(PROCESS_ALL_ACCESS, FALSE, process_id);
    if (hProcess==NULL)
        problem("OpenProcess()");

    // read patch location
    if (ReadProcessMemory(hProcess, (LPVOID)PATCH_LOCATION, &patch_int, 4, NULL)==FALSE)
        error ("ReadProcessMemory()");

    printf("patch_int = 0x%08x\n", patch_int);

    // check if patch location contains expected value
    if (patch_int==250)
    {
        // if so, overwrite with patch value
        patch_int=0xFFFFFFFF;
        if(WriteProcessMemory (hProcess, (LPVOID)PATCH_LOCATION, &patch_int, 4, NULL)==FALSE)
            error ("WriteProcessMemory()");
    }
    else
    {
        // or fail
        error("patch_int");
    }

    // detach from process
    DebugActiveProcessStop((DWORD)process_id);
    printf("success!\n");
};

Name: Anonymous 2006-02-06 16:18

Why in the name of Ken would you want to do this?

Name: Anonymous 2006-02-06 17:07

>>4

There are lots of fun reasons.  And even the occasional legitimate one!

Name: Anonymous 2006-02-06 18:08

Search and replace. For example:

Current money = 123897; search F9 E3 01 00, replace by FF FF FF FF, lol

Name: Anonymous 2006-02-06 18:46

>>6

I might replace it with something more like FF FF FF 7F on the off chance that it's being stored in a signed variable.  Assuming we're on an x86 or little-endian platform.

Name: Anonymous 2006-02-06 19:10

>>7
Oh yeah. It's been a long time since I did this kind of thing :) . I'd also try FFFFFF00, and see if 16.8M will suffice, some old games glitched with such high numbers.

Name: Anonymous 2006-02-27 10:15

You don't need DebugActiveProcess / DebugActiveProcessStop to read & write process memory. If you omit these then it can run on earlier NT-based systems that don't support DebugActiveProcessStop.

Name: Anonymous 2006-03-01 3:47

>>9
>earlier NT-based systems

These should fucking die already. Why do you people keep supporting that crap?

Name: Anonymous 2006-03-01 8:36

>>10
NT4 is crap, but Windows 2000 (which also doesn't support DebugActiveProcessStop) is still adequate for many applications. And has the bonus of requiring none of that activation shit that XP & 2003 have.

Name: Anonymous 2006-03-01 15:26

>>11
Also, it isn't supported anymore and the successor to the XP generation will soon be out.

Name: Anonymous 2006-03-01 16:25

>>12
That's not a successor, that's a joke. And because of it, most people will stick to Windows 2000 or XP.

Name: Anonymous 2006-03-01 17:03

>>13
>most people will stick to Windows 2000 or XP.

ROTFL.

Every time a new generation of Windows comes out, there are "hardcore" nerds who think the revolution will start now. One year later, nobody gives a fuck anymore.

Name: Anonymous 2006-03-02 3:23

Yes, most people will stick to XP. This is because most people have no clue how to install a new operating system, or even why they should (or should not).

However within a few years Hasta la Vista will dominate the desktop market because it will come preinstalled on every Dell, eMachines and other OEM piece'o'crap that people buy because the nice salesman told them they honestly need the latest Intel offering - complete with a crippled motherboard, not enough RAM, and integrated DRM - to look at web pages, listen to legally purchased mp3s and send emails written in Comic Sans.

Name: Anonymous 2006-03-02 4:43

>>15
Fucking win for truth (albeit sad)

Name: Anonymous 2006-03-02 5:18

>>15
WTF? Most people? Everybody who buys a new PC will get Vista. And there will also be people who will upgrade because they believe "it's better and faster or something, duh".

I will upgrade because I hate running old shit.

Name: Anonymous 2006-03-02 5:21

>>17
Read what I wrote you dumb shit.

Name: Anonymous 2006-03-02 6:43

>>12

It's still supported, albeit less so:

http//www.microsof/...

Name: Anonymous 2006-03-02 6:55

>>17
You're the kind of idiot that will fall for digital rights infringement and treacherous computing. You won't be able to even control what processes run in your OS or run your own code natively, unless you're with Microsoft and enforce treacherous computing yourself to get licenses. You won't be able to run others' free software, and you'll probably have trouble using your own files unless you purchase from Microsoft, AOL, or Sony.

I'm a Windows 2000 user and developer. I prefer Windows as a workstation OS, and work on it daily. But I'm not stupid. If we can't crack Vista and get rid of the treacherous computing and digital rights infringement in it, I will never upgrade. In fact I was thinking not to upgrade for several other reasons, including performance, memory, and bloat, the same reasons I'm using 2000 not XP. I'll stay with Windows 2000 until there are more 64 bit devices released, then move to Windows Server 2003, and stay with it for as long as I can. Vista's kernel is not too different; most things will still run for many years after Vista, just like with XP.

By the day I'm forced to upgrade by software, then I'll see whether I can crack Vista, or say Hasta la Vista to Windows and move to ReactOS (if it's enough developed by then) or Linux (even if I have to cope with the fucking FHS ugly mess, a sluggish GUI, and compiling others' shit).

Name: Anonymous 2006-03-02 10:33

>>20
Your first paragraph is complete nonsense. For Microsoft to force such a limited operating system as their standard Windows platform would be commerical suicide for their OS division.

I can see this happening on embedded Windows machines (e.g. dedicated Media Center boxes), indeed a similar system already operates on X-Box. But the idea that this will be compulsary for all Windows PCs is bogus.

Name: Anonymous 2006-03-02 10:59

>>21
As a matter of fact, Microsoft already said all digital rights infringement processes will be invisible and unstoppable in Vista, even for administrators with all privileges. Google Palladium (IIRC) and read their intents.

Name: Anonymous 2006-03-02 13:12

>>22
I was more taking issue with this statement: "You won't be able to even control what processes run in your OS or run your own code natively, unless you're with Microsoft and enforce treacherous computing yourself to get licenses."

Name: Anonymous 2006-03-02 18:21

You won't be able to even control what processes run in your OS
Already happening in Vista

run your own code natively, unless you're with Microsoft and enforce treacherous computing yourself to get licenses
This is the Palladium project
http://www.cl.cam.ac.uk/~rja14/tcpa-faq.html

Name: Anonymous 2006-03-02 18:33

>>23
What part of "Microsoft already said all DRM processes will be invisible and unstoppable" do you fail to grasp?

Name: Anonymous 2006-03-02 18:47

>>20
[quote]Linux, even if I have to cope with (1) the fucking FHS ugly mess, (2) a sluggish GUI, and (3) compiling others' shit[/quote]

(1) Are you implying that Windows has a neater file organization than Linux's FHS? Ha!

(2) When I'm using Linux the GUI works fine (except for Firefox which is a shitty piece of shit anyway.) When I'm using Windows everything is so sluggish that I feel like beating my mouse frantically with an iron rod. (Yes I keep an iron rod by my PC, just in case.) Are you sure you didn't install all the latest bells and whistles on an old pc, because you didn't know any better?

(3) Who ever told you to compile shit if you don't want to? Ever heard of binary packages? Debian for instance has 15,000+ precompiled binary packages that follow strict guidelines and fit nicely with each other. Most other distributions do that as well.

Do you, by any chance, base your experience with Linux on some epenis-inspired fucking around with Gentoo or similar NerdCore stuff?

Name: Anonymous 2006-03-02 18:48 (sage)

I swear, the day I unsderstand how quoting works on this board...

Name: Anonymous 2006-03-02 18:59

>>26
Are you implying that Windows has a neater file organization than Linux's FHS? Ha!
Yes, because application files aren't tossed into your filesystem directories as you deal playing cards in a fucking Poker game. Yes, because Linux' retarded way library paths work force you to toss all the shit into shared folders. Yes, because /usr, /sbin, /var, /opt, and pretty much anything else are stupid, poorly named, easily misunderstood, and wrongly used. Yes, because in Windows NT you control filesystem hierarchy, while in mother Unix filesystem hierarchy controls you. Yes, because applications are so much easier to move by hand without collecting files from everywhere like a faggot. Yes, because FHS is just gay.

When I'm using Linux the GUI works fine (except for Firefox which is a shitty piece of shit anyway.) When I'm using Windows everything is so sluggish that I feel like beating my mouse frantically with an iron rod.
This is just not serious. You Linux fanboys will just reverse whatever criticism anyone throws at it. If I said Linux looks Unixy and it's a bad thing, you'd claim that it's Windows what looks more Unixy.

Are you sure you didn't install all the latest bells and whistles on an old pc, because you didn't know any better?
I installed and toned down KDE on an Athlon 64 Venice with 512 MB RAM and a suitable accelerator, is this an old computer to run X?

Who ever told you to compile shit if you don't want to?
Linux fags keep telling me

Ever heard of binary packages?
Yes, if only they were always available

Do you, by any chance, base your experience with Linux on some epenis-inspired fucking around with Gentoo or similar NerdCore stuff?
Never used Gentoo, nor tried to compile something just for some slick optimisation.

Name: Anonymous 2006-03-02 19:02

>>28
I forgot to add: more on FHS: Yes, because every stupid program thinks it owns your fucking home directory and has the right to write all the shit they want there. Yes, because my homedir list looks fugly.

Name: Anonymous 2006-03-02 19:24

>>29
Signed 100x. I hate that.

Name: Anonymous 2006-03-02 19:46

On my work box XP takes 30 seconds to boot.

It takes SuSE 120-140 seconds (depending on which DE).

Holy fuck. Not everyone uses Slackware anymore, you know?

Name: Anonymous 2006-04-28 8:27

>>29

Same thing happens on Windows - look at Application Data and Local Settings folders in your profile.

Name: Anonymous 2006-04-28 11:06

>>32
Nice try, but these are folders intended for applications to store their shit, and not your home directory. It's the same idea, only done well.

Name: Anonymous 2006-04-28 11:41

>>33
Sure that's what they're intended for, but do apps use them? Fuck no, they assume you have admin rights and store their shit in C:\Program Files\Some Company\Lame Product\ and then start behaving strangely when you try to use them as a luser.

Also, what's the deal with storing some config files under ~/.foobar/? dotfiles are hidden unless you want to show them, so don't give me crap about making your homedir look ugly. It's not ugly if you don't see it.

Name: Anonymous 2006-04-28 12:03

>>34
You can give them rights to store these files in these directories for all users.

The deal with ~/.higuyz is my home directory is full of shit, and I want to always show these hidden files because hiding files is a vomit of a luser idea/hack (more fit for a stock Windows installation than a Unix OS BTW) and an insecure practice. I want to know what's everywhere because I control my box, this is not Mother Russia, plus I usually edit these files by hand.

And there's always software who thinks it's the best application in the Universe and doesn't even bother to use a dot file (GNAAstep, for example). Not only it's fugly and spam, but it's even between my regular files.

Name: Anonymous 2006-04-28 14:13

>>35
So you want to always show hidden files, and yet bitch when you see them. You're stupid<! Well done.

Name: Anonymous 2006-04-28 14:16 (sage)

>>32
>>34
Contradiction

Name: Anonymous 2006-04-28 18:47

>>36
I don't bitch when I see them. I bitch when I see bullshit in my home directory, regardless of if it's "hidden" for lusers or not.

Name: Anonymous 2006-04-28 19:56

GNAAstep = GNUstep?  lol

Name: Anonymous 2006-05-31 4:51

>>39
what

Name: Anonymous 2006-05-31 7:04

>>40
Good job for bumping it

s/GNU/GNAA/g

Name: Anonymous 2007-11-29 7:31

bump that shit bitches

Name: Anonymous 2007-11-29 7:52

>>42
Good job for bumping it

Name: Anonymous 2007-11-29 8:38

>>19
wait, how the fuck did you link to that

Name: Anonymous 2007-11-29 8:58

>>44
read sicp

Name: Anonymous 2007-11-29 12:54

Oh wow, nice to see this one again. I was OP.

Name: age 2007-11-29 23:18

age goes in all fucking fields. Which aren't that many on Shiichan.

Name: Anonymous 2007-11-30 0:22

>>46
NO YOU WERE NOT, I START THIS THREAD, I AM THE OP

Name: Anonymous 2009-03-18 2:13

I feel the need, the need for weed!

Marijuana MUST be legalized.

Name: Anonymous 2010-12-06 9:06

Back to /b/, ``GNAA Faggot''

Name: Anonymous 2013-06-02 19:32

check these dubs

Name: Anonymous 2013-06-02 21:09

what dubs? shitty dubs.

Don't change these.
Name: Email:
Entire Thread Thread List