|
I'm making a memory reading application, but after some programming I noticed I actually get the same result for no matter which process.  I'll give a very clear example of my problem. This piece of code opens three processes, and reads their memory at position 0x0000FFFF. The processes can be whatever I want (as long as they're running, obviously), but for this example I took Firefox, TeaTimer (background process of Spybot) and Nexcal (a calculator program).
<br />
public static void Test()<br />
{<br />
IntPtr bytesRead = new IntPtr();<br />
<br />
IntPtr firefox = OpenProcess(PROCESS_ALL_ACCESS, 0, (uint)Process.GetProcessesByName("firefox")[0].Id);<br />
byte[] firefoxBuffer = new byte[3];<br />
Trace.WriteLine("Firefox reading success: " + ReadProcessMemory(firefox, new IntPtr(65536), firefoxBuffer, (uint)3, out bytesRead));<br />
foreach (byte b in firefoxBuffer)<br />
{<br />
Trace.WriteLine(b.ToString());<br />
}<br />
CloseHandle(firefox);<br />
<br />
IntPtr tea = OpenProcess(PROCESS_ALL_ACCESS, 0, (uint)Process.GetProcessesByName("TeaTimer")[0].Id);<br />
byte[] teaBuffer = new byte[3];<br />
Trace.WriteLine("TeaTimer reading success: " + ReadProcessMemory(tea, new IntPtr(65536), teaBuffer, (uint)3, out bytesRead));<br />
foreach (byte b in teaBuffer)<br />
{<br />
Trace.WriteLine(b.ToString());<br />
}<br />
CloseHandle(tea);<br />
<br />
IntPtr nex = OpenProcess(PROCESS_ALL_ACCESS, 0, (uint)Process.GetProcessesByName("Nexcal")[0].Id);<br />
byte[] nexBuffer = new byte[3];<br />
Trace.WriteLine("Nexcal reading success: " + ReadProcessMemory(nex, new IntPtr(65536), nexBuffer, (uint)3, out bytesRead));<br />
foreach (byte b in nexBuffer)<br />
{<br />
Trace.WriteLine(b.ToString());<br />
}<br />
CloseHandle(nex);<br />
}<br />
Now here's the output of this code:
Firefox reading success: 1
61
0
58
TeaTimer reading success: 1
61
0
58
Nexcal reading success: 1
61
0
58
I even used different buffers just so I won't make a mistake with accidentally just printing the previous result again. Anyways, it explicitly says it succeeded reading that certain process at that certain position of their memory, but it still returns exactly the same result for the three processes. Now I was thinking this might be an absolute memory location I'm reading. But that wouldn't explain why I'd have to pass a process handle to the kernel32 functions. And it would make it all very complicated and quite useless.
|
|
|
|
|
look here: http://www.codeproject.com/KB/trace/minememoryreader.aspx[^]
Silence is the voice of complicity.
Strange women lying in ponds distributing swords is no basis for a system of government. -- monty python
Might I suggest that the universe was always the size of the cosmos. It is just that at one point the cosmos was the size of a marble. -- Colin Angus Mackay
|
|
|
|
|
I tried the example you gave, and it gives exactly the same result as my code. Hehehe, it seems my code was just totally perfect. Apparently many processes in Windows have certain pieces of their allocated memory identically. Is it some Windows-header or so? Anyway, I tried some other more unusual processes, like winlogon.exe (some Windows process), and he just gives something else. And I also tried some other memory positions alot further than 0xFFFF, like 0x20083, and that gives results different from process to process.
Just got unlucky to try the wrong processes at the wrong places.
Edit: I suddenly notice I actually succeeded reading the memory of a windows process (winlogon.exe), it didn't work after I tried it again...
|
|
|
|
|
Hi,
I need to create a simple e-mail application with basic functionality using C#. I dont want the source code but i would really appreciate if anyone could guide me as to what i should do...
Thanx,
Nadeem.
P.S: Im a comlete n00b in C#. 
|
|
|
|
|
look at the open source ThunderBird project.
Silence is the voice of complicity.
Strange women lying in ponds distributing swords is no basis for a system of government. -- monty python
Might I suggest that the universe was always the size of the cosmos. It is just that at one point the cosmos was the size of a marble. -- Colin Angus Mackay
|
|
|
|
|
I dont think u got me .... im a n00b . if i could go through the code of thuderbird, i wouldnt have been here  and i dont think Thunderbird has been developed using purely C# ....
Thanx anyway 4 ur time...
N.
|
|
|
|
|
if you're a n00b, then it doesn't really matter which language you use to learn the ideas. they can be applied in any language.
And, that's how I learned: by studying code other excellent programmers wrote (don't personally know if that really applies to thunderbird code).
programming is programming regardless of language used. what you learn can be applied to C#.
There is the System.Net.Mail namespace that has a lot of stuff in it that you'd need.
Why not get started trying something and then ask more appropriate, *small-scope* questions.
First break down the problem into smaller pieces. Then break those pieces into even smaller pieces and repeat until you get something that you can do in a few steps. accomplish all those smallest pieces, and you will have solved the larger ones.
Silence is the voice of complicity.
Strange women lying in ponds distributing swords is no basis for a system of government. -- monty python
Might I suggest that the universe was always the size of the cosmos. It is just that at one point the cosmos was the size of a marble. -- Colin Angus Mackay
|
|
|
|
|
Why do you need to create a mail program ? There's plenty out there.
N4D33M wrote: Im a comlete n00b in C#.
Then if this is a job you've accepted, you should let them know it is beyond you. If it's a personal project, start with something more within your reach. Most people who give up on programming, do so because they didn't set themselves reasonable goals. They expected to start big, instead of learning at a reasonable pace.
Christian Graus - Microsoft MVP - C++
"also I don't think "TranslateOneToTwoBillion OneHundredAndFortySevenMillion FourHundredAndEightyThreeThousand SixHundredAndFortySeven()" is a very good choice for a function name" - SpacixOne ( offering help to someone who really needed it ) ( spaces added for the benefit of people running at < 1280x1024 )
|
|
|
|
|
Thanx u all for your replies ...i guess i will have to study a bit more before i delve into such projects .... btw its a project just for fun and information ....
N4D33M.
|
|
|
|
|
I have a problem where i am using a TextBox with the MultiLine property set to true. This is for operators to enter an address, which is saved, and printed to a label.
However...
We've a problem were operators, who have the ability to always do the unexpected, are holding the space bar until the cursor gets to the next line in the textbox instead of using enter/return, which means the labels which are then printed are screwed (attempting to put the entire address on one line)
Has anyone any ideas how to tackle this so the user can't use space bar to pad to the next row and have to use return?
Thanks
|
|
|
|
|
This sounds like a training issue rather than a technical one, however you could intercept each keypress and if it is a space character with a preceeding space character then you could remove 1 char from the end of the textbox - thus stopping the user from being able to enter multiple space chars.
|
|
|
|
|
Thanks for the response
i would love it to be a training issue but they guys working on the packing benches in our warehouse arent exaclty IT literate.
The idea is to just stop them doing anything other than what they should be doing!
I've considered the keypress but thought there may be a better solution.
I suppose i should know by now to always expect the unexpected.
|
|
|
|
|
You could put a message box with the message "Your supervisor has been warned of your overuse of spaces"
|
|
|
|
|
 i like it
or
"GET OFF THAT SPACE BAR: REFER TO MANUAL"
|
|
|
|
|
I agree with Jamie that it's primarily a training issue, but it's also one of validation.
Before accepting the data as entered you should be scrubbing the text entered and looking for multiple spaces next to each other and various other irregulaties that would break your output.
You should always be treating user input as if they're a bunch of demonic 2 years olds mashing the keyboard. Would you trust anything they enter?? Your code shouldn't trust it either...
|
|
|
|
|
trust me there are more checks on that address than there are at US customs on a flight from Colubia, but i'm not dealing entirely with my own system. i hate to interact with others. Its complicated. And also why i hate contractors. Overpaid and leaving me to clean up the mess.
|
|
|
|
|
blakey404 wrote: there are more checks on that address than there are at US customs on a flight from Colubia
Wanna bet?? Guess who I work for, as a contractor, who's grossly underpaid...
|
|
|
|
|
hehehe to be honest it is a particular contractor i mean to aim my anger at, not all of you 
and yes i do wanna bet, the whole despatch system is based on postcodes (UK) for validation to lots and lots of checks are done. its a simple fact that this is the manual override option which is required because the UK post office cannot release their updates (to address based on postcode) quick enough for us to rely on it completely. So there does need to be a manual override, it just needs to allow as much but also as little functionality as possible, if that makes sense.
Cheers
Anthony
|
|
|
|
|
blakey404 wrote: And also why i hate contractors
Way to alienate people trying to help you.
|
|
|
|
|
 grumpy contractor
|
|
|
|
|
Dave Kreskowiak wrote: You should always be treating user input as if they're a bunch of demonic 2 years olds mashing the keyboard. Would you trust anything they enter?? Your code shouldn't trust it either...
Thats brilliant, and very true.
He who makes a beast out of himself gets rid of the pain of being a man
|
|
|
|
|
Hi!
I guess the easiest solution will be to turn off word wrapping.
That way they can enter as many spaces as they like, they only get the TextBox to scroll horizontally once the right margin is reached and then (hopefully) they see the error in their ways. 
Regards,
mav
--
Black holes are the places where God divided by 0...
|
|
|
|
|
i considered that to be honest and its currently looking like my favourite solution as they cannot get to the next line that way without using return 
|
|
|
|
|
A few years back, i worked on a project where permissions were handled by assigning a number to a user, and that number would then be read as a "binary" (if i remember correctly), ie, it would then get broken up into its parts based on the 1,2,4,8 scale.
so 3 = 1 and 2
7 = 1 and 2 and 4 and so on.
i know there is a method for interpreting this in c#, but i no longer work for that company, and a need to use a similar method of interpretation has come up. so, could someone please point me toward the method for interpreting this, and, let me know if i am calling it the right thing?
thank you
______________________
Mr Griffin, eleventy billion is not a number...
|
|
|
|
|
More commonly refered to as bitwise operation, you use the | and & operators. (& to interpret if a particular "bit" is set, and | to set a particular "bit").
Some examples.
<br />
int myNum = 1;<br />
myNum = myNum | 2;
To use this in a boolean expression, you can check the result != 0 (which effectively means the "bit is set".
<br />
if( (myNum & 2) != 0)<br />
{<br />
}
|
|
|
|
General 
News 
Suggestion 
Question 
Bug 
Answer 
Joke 
Praise 
Rant 
Admin 
Submit an article or tip
