2

I am making a memory editor for an application written in Python. I've successfully grabbed the memory data from the target process using OpenProcess and ReadProcessMemory functions from the kernel32.dll. Once i have the data i manipulate it accordingly using python, and i pass it into a gui that i've created.

What i want to do is this: Because the data that i grab contain static memory addresses, and there is no other way to write back to memory without calling WriteProcessMemory again, i thought of creating pointers that point directly to the static memory addresses so that with some tweaks in the gui, the values will get immediately back in memory.

I tried to do this using ctypes cast function, which successfully creates the pointer (at least it does not spawn any error) but when i am trying to get the pointer contents, python crashes, so the only logical explanation is that the python script does not have direct access to the process memory space in order to load the data.

Because of my lack of experience on the matter, i have no idea what i can do to make this possible. Is this where dll injection comes in handy? My only other option is to store the memory data as a file object in python, don't make use of the static pointers (that means a lot of conversions), make my changes and put the data back using WriteProcessMemory.

Any help is highly appreciated

2

Memory in almost all modern OSes is virtualized, which means each process has its own address space. This means that the same addresses holds a different value in your python program than it holds in your debugee.

So, the only way to patch that memory is WriteProcessMemory, there's no way to access the memory of your debugee with any kind of pointer.

If you inject a DLL into the debugged process, that DLL could access the memory of that process directly, however, this still leaves you with the problem of how to communicate with the DLL, since you can't just call any functions in it if it's not in your process space. Combined with all other problems this may cause, i'd strongly recommend against that.

  • Thanks a lot for your answer, but i have a question. Since each process has its own address space, this means that python shouldn't crash when i am requesting a value on a specific address. It should have just returned another value. Can you explain what's exactly going on and python crashes? – Greg K. Jun 24 '15 at 14:51
  • Likely because you're trying to read memory that isn't mapped/allocated in the Python process's address space. – Jason Geffner Jun 24 '15 at 15:12
  • So virtually there is the maximum page size available to the process, but its actual size and use come from whatever has already been allocated in there? – Greg K. Jun 25 '15 at 14:23
  • The whole address space (4 GB in a 32 bit OS) is divided into many small pages (typically 4KB-64KB). Each of these pages can be mapped to something in real RAM (code, data, stack, a file your program has open), something that could be in RAM but has been swapped out to the paging file, or nothing at all. The pages at the same address in different processes normally refer to something different, but there are exceptions, like two processes sharing the code section of a DLL. – Guntram Blohm Jun 26 '15 at 6:27
0

By design in Windows, each process have their own virtual address space, thus you can't create a pointer to another process memory if it hasn't been created specifically as a shared memory, that's why RPM/WPM exist.

On the other hand, DLL injection allows you to inject your code in a target process, so you can access directly to the target process memory. It is certainly the most performant way to access data, however you'll have to code an interface if you want to export the data to the outside (socket, shared memory, whatever). Basically, you'll have to do what RPM/WPM do for you.

In my opinion, RPM/WPM should be enough for what you need, you can call it multiple times per second without much trouble.

  • Thanks for your answer mate, i guess RPM/WPM is with what i'll go for now. – Greg K. Jun 24 '15 at 14:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.