Pregunta

I have PE file that was made with 16bit delphi. I spent all day trying to use WriteProcessMemory() on this file. It doesn't work. I can't find adresses in cheat engine nor tsearch. Peid says that file is not valid PE, I guess thats because of 16 bits?

Do you have any ideas how to read these adresses ? I can post exe if needed.

¿Fue útil?

Solución

Delphi 16bit didn't make PE files. It made NE files... IOW, NE = "New Executable" and PE = "Portable Executable" NE files were introduced in Windows 32bit with the release of Windows NT 3.1 around '92 or '93.

It is not likely that you'll be able to read the memory of a running 16bit process from a 32bit process. This is because a 16bit application will run within a special subsystem that emulates the 16bit environment.

Licenciado bajo: CC-BY-SA con atribución
No afiliado a StackOverflow
scroll top