mercredi 29 janvier 2014

[Coding] RPM Error Code 299 topic




I am writing a personal SigScanner in C# that I have based on a more primitive pattern scanner (also developed my me) that I used successfully with Arma2. The primitive scanner did not use a pattern mask for unimportant elements while the new one does. The issue that I am having with my new SignScanner is at the testing level.

I have drafted a simple C# console app that prompts the user for an integer value and then increments a static variable by the entered value. My test is to be able to create a signature that will always be able to locate the address that the static variable occupies. I am able to use Cheat Engine and OllyDbg to find the variable address and create the signature. But when I try to read the entire process main module's byte array using RPM the RPM Function returns false and Marshal.GetLastWin32Error() returns 299. This isn't the exact code that I am using, but essentially the RPM call that I am making is this (all necessary variables are initialized elsewhere in code):


Code:


Process targetProcess;
byte[] buffer = new byte[targetProcess.MainModule.ModuleMemorySize];
int bytesRead;
ReadProcessMemory(targetProcess.Handle, targetProcess.MainModule.BaseAddress, buffer, targetProcess.MainModule.ModuleMemorySize, out bytesRead);


Is there anything wrong with this call for a C# (managed) target application? Am I potentially trying to read portions of memory which don't belong to the target application because it is spread out over the heap due to garbage collection? Is there a different, safer way to get a module's byte array than using RPM?





Aucun commentaire:

Enregistrer un commentaire