ReadProcessMemory() fails due to PAGE_NOACCESS flag(?)

312 Views Asked by At

I'm trying to read an integer value from a foreign process with the C++ code below (using C++Builder as IDE).

Both applications are 64-bit, but the ReadProcessMemory() function fails with error 299 (ERROR_PARTIAL_COPY). If I compile a second test application and try to read a value from it, it works fine. But I can't read the memory from the foreign process. I noticed that the memory area in the foreign process seems to be protected with the PAGE_NOACCESS flag. I tried to overwrite it with VirtualProtectEx() but it doesn't change the flag and I still can't read the memory. Is my code wrong?

void __fastcall TForm1::Button1Click(TObject *Sender)
{
    DWORD procid;
    HANDLE hproc;
    long long addrPosX = 0x7FF62C66DA20;
    int iBuffer = 0;
    UInt64 rw = 0;
    unsigned long oldProtect;

    procid = 992;

    try
    {
      hproc = OpenProcess(PROCESS_VM_READ | PROCESS_VM_WRITE, FALSE, procid);
      //VirtualProtectEx(hproc, (LPVOID)addrPosX, sizeof(iBuffer), PAGE_READWRITE, &oldProtect);

      // Read value
      if (ReadProcessMemory(hproc, (LPCVOID)addrPosX, &iBuffer, sizeof(iBuffer), &rw)) {
        lblPosX->Text = "Value: " + String(iBuffer);
      } else {
        lblPosX->Text = "Value: Failed reading memory (" + String(GetLastError()) + ")";
      }

      //VirtualProtectEx(hproc, (LPVOID)addrPosX, sizeof(iBuffer), oldProtect, &oldProtect);
      CloseHandle(hproc);
    }
    catch (Exception &e)
    {
      ShowMessage("Error OpenProcess(): " + e.Message);
    }
}
0

There are 0 best solutions below