so i cant read an integer from my usermode idk why i will share the code cuz i found it and its public hope that someone could help me with this :D
in kernel space
<pre>typedef struct {
DWORD64 proccessId;
DWORD64 address;
DWORD64 Read;
} MEMDATA;
UINT64 ReadMem(MEMDATA *data) {
NTSTATUS ntStatus;
PEPROCESS targetProc;
UINT64 readBuff;
ntStatus = PsLookupProcessByProcessId((HANDLE)(*data).proccessId, &targetProc);
if (ntStatus != STATUS_SUCCESS || !targetProc)
return;
__try {
KeAttachProcess((PKPROCESS)targetProc);
if (MmIsAddressValid((void*)(*data).address))
RtlCopyMemory(&readBuff, (const void*)(*data).address, sizeof(readBuff));
KeDetachProcess();
}
__except (GetExceptionCode()) {
return;
}
return(readBuff);
}
<pre> case(READ): {
MEMDATA *userCom = pBuf;
DWORD64 retVal = ReadMem(userCom);
RtlCopyMemory(pBuf, &retVal, sizeof(retVal));
size = sizeof(retVal);
break;
}
also am using method buffered
#define READ CTL_CODE(FILE_DEVICE_UNKNOWN, 0x0701 /* Our Custom Code */, METHOD_BUFFERED, FILE_SPECIAL_ACCESS)
and here is my template for reading an integer
<pre> int Readint(DWORD64 pid, DWORD64 addr, DWORD64 len) {
MEMDATA toSend;
DWORD64 dwBytesRead = 0;
DWORD64 readBuffer;
toSend.proccessId = pid;
toSend.address = addr;
toSend.Read = len;
DeviceIoControl(hDriver, READ, &toSend, sizeof(MEMDATA), &readBuffer, len, 0, 0);
CloseHandle(hDriver);
return(readBuffer);
}
but its not working am trying to read (
123456
) but its reading it like this (
-1676839616
) i guess that driver is reading it but its a problem with the buffer idk .
What I have tried:
i have tried this to read
<pre> int PID;
cout << "give PID" << endl;
cin >> PID;
int test;
test = Driver.Readint(PID, 0xB33B92FD88,sizeof(test));
if (test) {
cout <<"working boi" << test <<endl;
}
else
{
cout << "nope not working" << endl;
}
but its not working and also pls if you know the fix of this problem dont just tell me its that or that just pls give me or show me the code to fix it and also am new to kernel sorry if i look like a noob but we are learning every day !