How to find the starting address of an application for memory editing a process?

StackOverflow https://stackoverflow.com/questions/8086705

  •  26-02-2021
  •  | 
  •  

سؤال

I want to know how to find the valid addresses of an application from beginning to end because I want to know how to memory edit an application for example Notepad. Do I have to decompile the application and see the assembly code or machine code. Because I see people always making mods for applications like minesweeper and some PC video games.

P.S. I will be using the programming language C# and Win32 functions to perform the memory editing.

هل كانت مفيدة؟

المحلول

To find the start and end addresses for a process

Process proc = Process.GetCurrentProcess();
IntPtr startOffset = proc.MainModule.BaseAddress; 
IntPtr endOffset = IntPtr.Add(startOffset ,proc.MainModule.ModuleMemorySize); 

http://www.ownedcore.com is a good resource to learn about memory editing.

نصائح أخرى

First, you use GetSystemInfo Win32API function to get minimum and maximum virtual addresses available to applications. Then you scan chunks of memory starting from the minimum address and ending at the maximum address available. But you skip(you don't scan them) all the chunks which you can't read. Here's a post on CodeProject which shows that: https://www.codeproject.com/articles/716227/csharp-how-to-scan-a-process-memory

مرخصة بموجب: CC-BY-SA مع الإسناد
لا تنتمي إلى StackOverflow
scroll top