Read a struct from memory

Question

I'm trying to load a struct defined in a program that i'm reading the memory of, so I can use it to define objects in my python debugger (in windows).

What format do structs take in memory, and what information can i get from finding the struct. Is it possible to find the offsets for all attributes, and all objects linking to the struct?

I'd prefer to be able to do this without using breakpoints, but I can use them if there is no other way.

Answer 1

You should rather ask your questions with some kind of example output so that answers are not based on guesswork.

Does iam loading the struct mean

• I wrote a program where I am employing OpenProcess() ReadProcessMemory()

or does it mean

• i am opening the raw file with FILE * fp ; fopen("c:\XXX","wb") fread(fp); or load it in say ollydbg or in a hexeditor

Assuming you use ReadProcessMemory the buffer you provided will be filled with bytes. It is up to you to cast it to proper type for accessing various members of the struct (yes you need a valid prototype of the structure beforehand).

A pseudo form could be like this

type result;
BYTE foo[0x100];
Mystruct *blah;
int s1;
PSTR s2;
result = ReadProcessMemory(where,howmuch,destination,VerifiactionPointer)
blah = (MyStruct *)destination;
s1 = blah->someint;
s2 = blah->somestring;

Memory you see will always contain hex bytes that are indistinguishable from one another. It is like clay in the hands of a potter.

Only the artisan can give it form. Clay by itself can never become a statue or a finely crafted teapot.