hooking into a window and peeking/poking memory
in [Visual Studio]
|
From: 5k3105 on 27 Jul 2010 12:40 I want to open a game program of mine running in an windows emulator and read and write directly to offsets in that memory space. So I need the base address of the process/window. If I start it from my program maybe it will be easier to get the base address? I already have a program that will allow me to scroll the memory space in hex I just need a way to get the base address. Thanks.
From: Karl E. Peterson on 27 Jul 2010 13:14 5k3105 expressed precisely : > I want to open a game program of mine running in an windows emulator > and read and write directly to offsets in that memory space. So I need > the base address of the process/window. > > If I start it from my program maybe it will be easier to get the base > address? > > I already have a program that will allow me to scroll the memory space > in hex I just need a way to get the base address. Define "base address" as you use it. In Win32, all processes have a 4gb virtual address space. So the quick/dirty answer would be 0x0 in that case. http://en.wikipedia.org/wiki/Virtual_address_space -- ..NET: It's About Trust! http://vfred.mvps.org
From: 5k3105 on 27 Jul 2010 13:49 On Jul 27, 12:14 pm, Karl E. Peterson <k...(a)exmvps.org> wrote: > Define "base address" as you use it. In Win32, all processes have a > 4gb virtual address space. So the quick/dirty answer would be 0x0 in > that case. Hi Karl, I'm using an emulator program called winvice to emulate the commodore 64. I want to be able to read and write to it's memory space while it's running in the emulator. From my reading I think I need to get the hWND or window handle and this number may be the base address of the section of memory that program is using (winvice). From there I will add another offset to find further the base address of the emulated computer's 64k by experiment. I imagine if I boot the program from vb maybe it will return the address I can use, like: BaseAddress = StartProgramFunction("C:\winvice.exe") Thanks.
From: Nobody on 27 Jul 2010 14:58 "5k3105" <christianlott1(a)yahoo.com> wrote in message news:9caa98d0-04de-4d7e-ae63-9dd568f32164(a)m1g2000vbh.googlegroups.com... >I want to open a game program of mine running in an windows emulator > and read and write directly to offsets in that memory space. So I need > the base address of the process/window. > > If I start it from my program maybe it will be easier to get the base > address? > > I already have a program that will allow me to scroll the memory space > in hex I just need a way to get the base address. Dependency Walker shows the base address.
From: ralph on 27 Jul 2010 15:05
On Tue, 27 Jul 2010 10:49:33 -0700 (PDT), 5k3105 <christianlott1(a)yahoo.com> wrote: >On Jul 27, 12:14�pm, Karl E. Peterson <k...(a)exmvps.org> wrote: > >> Define "base address" as you use it. �In Win32, all processes have a >> 4gb virtual address space. �So the quick/dirty answer would be 0x0 in >> that case. > >Hi Karl, > >I'm using an emulator program called winvice to emulate the commodore >64. I want to be able to read and write to it's memory space while >it's running in the emulator. > >From my reading I think I need to get the hWND or window handle and >this number may be the base address of the section of memory that >program is using (winvice). From there I will add another offset to >find further the base address of the emulated computer's 64k by >experiment. > >I imagine if I boot the program from vb maybe it will return the >address I can use, like: > > >BaseAddress = StartProgramFunction("C:\winvice.exe") > Peeking or reading the memory of another process is relatively easy. (Easy compared to trying to Poke or write into another process, that is. <g>) Take a look at this article: http://www.codeguru.com/vb/gen/vb_system/win32/article.php/c7525 You'll have to do some further searching on how to Poke. (I'm not even sure it can be done - although there is nothing truly impossible in programming.) The problem is basic - the O/S is designed from the ground up NOT to allow another process to mess around with another process - so you have to use system services provided or risk a GPF (old term). Even then it isn't a given you can reach everything. hth -ralph |