6

I'm trying to load a struct defined in a program that i'm reading the memory of, so I can use it to define objects in my python debugger (in windows).

What format do structs take in memory, and what information can i get from finding the struct. Is it possible to find the offsets for all attributes, and all objects linking to the struct?

I'd prefer to be able to do this without using breakpoints, but I can use them if there is no other way.

5

You should rather ask your questions with some kind of example output so that answers are not based on guesswork.

Does iam loading the struct mean

  • I wrote a program where I am employing OpenProcess() ReadProcessMemory()

or does it mean

  • i am opening the raw file with FILE * fp ; fopen("c:\XXX","wb") fread(fp); or load it in say ollydbg or in a hexeditor

Assuming you use ReadProcessMemory the buffer you provided will be filled with bytes. It is up to you to cast it to proper type for accessing various members of the struct (yes you need a valid prototype of the structure beforehand).

A pseudo form could be like this

type result;
BYTE foo[0x100];
Mystruct *blah;
int s1;
PSTR s2;
result = ReadProcessMemory(where,howmuch,destination,VerifiactionPointer)
blah = (MyStruct *)destination;
s1 = blah->someint;
s2 = blah->somestring;

Memory you see will always contain hex bytes that are indistinguishable from one another. It is like clay in the hands of a potter.

Only the artisan can give it form. Clay by itself can never become a statue or a finely crafted teapot.

  • It worth noting that structs in memory could be larger than what they should be according to the source code, unless pack where used in the definition of the struct they maybe aligned in memory hence be larger in size. – Hanan N. Sep 15 '13 at 4:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.