Exe Unpack or Process Spy - Getting process internals

Question

I want to rewrite a application tool in C# that is written in VB6. This application does not work in windows 8/10 due to some compatibility issues.

It is an old game server management tool. This application read and writes to another process memory(a game).

I want the memory address to which the tool write/read from.

The tool is only 42kb. and use kernel32.dll to read game process memory.

I tried to decompile this application from publically available decompiler but it didn't work. The file is packed with some PE-Pack was released by ANAKiN.

I also tried to read game memory values but unable to figure out which values i need because of a large amount of values.

Is there any way i can spy/spectate on this tool, to find out what it is requesting from kernel32 library. or what external memory addresses it is reading from or writing to ?.

Or there is any unpacker tool that can unpack the file so i can decompile it.

Answer 1

The easiest solution would be to monitor the application with API Monitor to see what parameters it supplies to ReadProcessMemory() and WriteProcessMemory().