I'm trying to read an integer value from a foreign process with the C++ code below (using C++Builder as IDE).
Both applications are 64-bit, but the ReadProcessMemory() function fails with error 299 (ERROR_PARTIAL_COPY). If I compile a second test application and try to read a value from it, it works fine. But I can't read the memory from the foreign process. I noticed that the memory area in the foreign process seems to be protected with the PAGE_NOACCESS flag. I tried to overwrite it with VirtualProtectEx() but it doesn't change the flag and I still can't read the memory. Is my code wrong?
void __fastcall TForm1::Button1Click(TObject *Sender)
{
DWORD procid;
HANDLE hproc;
long long addrPosX = 0x7FF62C66DA20;
int iBuffer = 0;
UInt64 rw = 0;
unsigned long oldProtect;
procid = 992;
try
{
hproc = OpenProcess(PROCESS_VM_READ | PROCESS_VM_WRITE, FALSE, procid);
//VirtualProtectEx(hproc, (LPVOID)addrPosX, sizeof(iBuffer), PAGE_READWRITE, &oldProtect);
// Read value
if (ReadProcessMemory(hproc, (LPCVOID)addrPosX, &iBuffer, sizeof(iBuffer), &rw)) {
lblPosX->Text = "Value: " + String(iBuffer);
} else {
lblPosX->Text = "Value: Failed reading memory (" + String(GetLastError()) + ")";
}
//VirtualProtectEx(hproc, (LPVOID)addrPosX, sizeof(iBuffer), oldProtect, &oldProtect);
CloseHandle(hproc);
}
catch (Exception &e)
{
ShowMessage("Error OpenProcess(): " + e.Message);
}
}