I want to rewrite a application tool in C# that is written in VB6. This application does not work in windows 8/10 due to some compatibility issues.

It is an old game server management tool. This application read and writes to another process memory(a game).

I want the memory address to which the tool write/read from.

The tool is only 42kb. and use kernel32.dll to read game process memory.

I tried to decompile this application from publically available decompiler but it didn't work. The file is packed with some PE-Pack was released by ANAKiN.

I also tried to read game memory values but unable to figure out which values i need because of a large amount of values.

Is there any way i can spy/spectate on this tool, to find out what it is requesting from kernel32 library. or what external memory addresses it is reading from or writing to ?.

Or there is any unpacker tool that can unpack the file so i can decompile it.

1 Answer 1


The easiest solution would be to monitor the application with API Monitor to see what parameters it supplies to ReadProcessMemory() and WriteProcessMemory().

API Monitor

  • ok i will try that Jan 19, 2016 at 21:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.