There is variable in data section:

.data:00427000 dword_427000    dd 64h

Base address of code is:

.text:00411000 ; Segment type: Pure code

How to calculate actual address and location in memory of this variable, for to usage with C++ OpenProcess and ReadProcessMemory?

Thanks in advance.

  • 1
    This isnt reversing related use something like OpenProcess->ReadProcessMemory(GetModuleAddress+rva) – blabb Sep 3 at 10:24
  • I did a bit confused, right variable location rva is 0x00027000. – black4 Sep 3 at 11:58
  • look for my answer in this thread for a basic idea in powershell reverseengineering.stackexchange.com/questions/15728/… – blabb Sep 3 at 18:59

If the ASLR isn't enabled for the module, and it's loaded at the address of 0x400000 this is as simply as

DWORD address = 0x427000;
ReadProcessMemory(handle, (void*)address, &value, sizeof(value), NULL);

However if the ASLR is enabled (or the process just isn't mapped to memory starting at 0x400000) you need to get base address of the module. I assume you aren't part of the process (because you want to use ReadProcessMemory) therefore you can't call GetModuleHandle, because the function allows to obtain the handle only for modules loaded in the calling process.

The easiest way to get external process module base that comes to my mind is via the TlHelp32 functions and could look like this:

DWORD GetModuleHandleExternal(DWORD pid, const wchar_t* module)
    DWORD base = 0;
    HANDLE handle = CreateToolhelp32Snapshot(TH32CS_SNAPMODULE, pid);
    MODULEENTRY32 entry;
    entry.dwSize = sizeof(MODULEENTRY32);
    while(Module32First(handle, &entry))
        if (!wcscmp(entry.szModule, module))
            base = (DWORD)entry.modBaseAddr;
    return base;

Then you can just simply call

HANDLE handle = OpenProcess(PROCESS_VM_READ, FALSE, pid);
DWORD base = GetModuleHandleExternal(pid, L"module.exe");
DWORD address = base + 0x27000;
DWORD value = 0;
ReadProcessMemory(handle, (void*)address, &value, sizeof(value), NULL);
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.