Defining Pointers outside the Target Proccess Memory Space

Question

I am making a memory editor for an application written in Python. I've successfully grabbed the memory data from the target process using OpenProcess and ReadProcessMemory functions from the kernel32.dll. Once i have the data i manipulate it accordingly using python, and i pass it into a gui that i've created.

What i want to do is this: Because the data that i grab contain static memory addresses, and there is no other way to write back to memory without calling WriteProcessMemory again, i thought of creating pointers that point directly to the static memory addresses so that with some tweaks in the gui, the values will get immediately back in memory.

I tried to do this using ctypes cast function, which successfully creates the pointer (at least it does not spawn any error) but when i am trying to get the pointer contents, python crashes, so the only logical explanation is that the python script does not have direct access to the process memory space in order to load the data.

Because of my lack of experience on the matter, i have no idea what i can do to make this possible. Is this where dll injection comes in handy? My only other option is to store the memory data as a file object in python, don't make use of the static pointers (that means a lot of conversions), make my changes and put the data back using WriteProcessMemory.

Any help is highly appreciated

Answer 1

Memory in almost all modern OSes is virtualized, which means each process has its own address space. This means that the same addresses holds a different value in your python program than it holds in your debugee.

So, the only way to patch that memory is WriteProcessMemory, there's no way to access the memory of your debugee with any kind of pointer.

If you inject a DLL into the debugged process, that DLL could access the memory of that process directly, however, this still leaves you with the problem of how to communicate with the DLL, since you can't just call any functions in it if it's not in your process space. Combined with all other problems this may cause, i'd strongly recommend against that.

Answer 2

By design in Windows, each process have their own virtual address space, thus you can't create a pointer to another process memory if it hasn't been created specifically as a shared memory, that's why RPM/WPM exist.

On the other hand, DLL injection allows you to inject your code in a target process, so you can access directly to the target process memory. It is certainly the most performant way to access data, however you'll have to code an interface if you want to export the data to the outside (socket, shared memory, whatever). Basically, you'll have to do what RPM/WPM do for you.

In my opinion, RPM/WPM should be enough for what you need, you can call it multiple times per second without much trouble.