2

I am completely new to Windows programming so please excuse any naivety on my part when asking this question. I'll briefly describe my situation and then hopefully you'll be able to answer my question.

I have a small executable file that was written in Delphi and packed with Aspack 2.12.

When the file runs there is a variable called Total which gets incremented. When the file exits a .dat file gets updated with the new Total value.

I can program something to 'read' the Total from the .dat file (just by using php or one of the languages I'm familiar with). However, I would like to read the Total value in "real time" when the executable is running (I don't need to 'write' to the Total value - just read it).

I wondered if there was any way of writing an application that would "reach in" to a running executable and read a variable out of it?

I remember back in the Spectrum days you could "peek" and "poke" memory. Is something like this feasible?

I wondered if this is even possible and, if so, how could I go about doing this?

|improve this question
  • @DominikAntal wow! That was lightning fast!!! :-) Thanks I'll Google it now. Any idea how I would know where in memory to read? And also would that memory address change every time the computer was started and the exe run? (thanks for the edit about CheatEngine - my work server blocks this but I'll look at this when I finish work :-)) – John T Jun 7 '17 at 9:11
  • Yep, will do that @DominikAntal thanks again. I take it that once I've identified an area with CheatEngine it's simply a case of writing some code in C++ to "ReadProcessMemory" in that location and read the variable I want? – John T Jun 7 '17 at 9:17
  • 1
    If your variable is static, it is possible that the same memory address you found via CE will work between application restarts. If its not static, you might be able to reach it via a pointer and offsets. Or via byte pattern scanning. All of these should be covered on this site.. – Dominik Antal Jun 7 '17 at 11:36
1

Look into ReadProcessMemory WinAPI, alternatively CheatEngine is a tool that can do all kinds of memory related operations for you (search, modify, freeze, debug, etc.).

You could also search on Github for some other memory "hacking" projects in a language that you are familiar with.

Cheat engine can find the exact memory address in the memory of the value you are looking for. You might be able to use some pointers to get the location of your value on each run, so you do not have to use CheatEngine each time to find the address. I recommend you go trough the tutorial which comes with Cheat Engine, so you get a better understanding of pointers :)

|improve this answer
  • I would like the process to ultimately be automated (i.e. I run the target .exe and then run some software I've written and then the value is read real-time into a text-file or whatever). Is that what the 'pointers' you mention allow me to do?? So that whenever I run the exe my software will automatically be able to still find the correct variable and read it out? – John T Jun 7 '17 at 9:21
  • Yes, that is what I meant. You have to determine if pointers are required for this at all, if you find your value at the same memory location in Cheat Engine after restarting your application, no pointers are needed. If the memory location changes, you will need to find a pointer (and offset(s)) to that value. I think the CE tutorial covers this subject as well! Alternatively you could try byte pattern matching as well but that is the third option. – Dominik Antal Jun 7 '17 at 15:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.