Domanda

I want to know how to find the valid addresses of an application from beginning to end because I want to know how to memory edit an application for example Notepad. Do I have to decompile the application and see the assembly code or machine code. Because I see people always making mods for applications like minesweeper and some PC video games.

P.S. I will be using the programming language C# and Win32 functions to perform the memory editing.

È stato utile?

Soluzione

To find the start and end addresses for a process

Process proc = Process.GetCurrentProcess();
IntPtr startOffset = proc.MainModule.BaseAddress; 
IntPtr endOffset = IntPtr.Add(startOffset ,proc.MainModule.ModuleMemorySize); 

http://www.ownedcore.com is a good resource to learn about memory editing.

Altri suggerimenti

First, you use GetSystemInfo Win32API function to get minimum and maximum virtual addresses available to applications. Then you scan chunks of memory starting from the minimum address and ending at the maximum address available. But you skip(you don't scan them) all the chunks which you can't read. Here's a post on CodeProject which shows that: https://www.codeproject.com/articles/716227/csharp-how-to-scan-a-process-memory

Autorizzato sotto: CC-BY-SA insieme a attribuzione
Non affiliato a StackOverflow
scroll top