ReadProcessMemory() Question 2

[lior654]

Whats wrong with this code:

I'm getting 299 error in ReadProcessMemory.

#include <windows.h>
#include <stdio.h>

//Give this program debugging priledges
bool AdjustPrivileges();

int main(int argc, char* argv[])
{
HANDLE hProcess;
LPVOID lpBuffer;
long lBufferSize;
DWORD dwBytesRead;

LPVOID lpMem = 0;
DWORD dwIndex = 0;
SYSTEM_INFO si;
MEMORY_BASIC_INFORMATION mbi;
DWORD dwOffset = 0;
LPVOID lpAddress;

int n = 97;

if( !AdjustPrivileges() ){
printf("Can't adjust priveldges!");
return 1;
}

hProcess = OpenProcess( PROCESS_ALL_ACCESS, FALSE, GetCurrentProcessId() );
if( hProcess == NULL ){
printf("OpenProcess() Failure!");
return 1;
}

GetSystemInfo(&si);

while( lpMem < si.lpMaximumApplicationAddress )
{
VirtualQueryEx( hProcess, lpMem, &mbi, sizeof(MEMORY_BASIC_INFORMATION) );

dwOffset = lBufferSize * mbi.RegionSize;
//lpAddress = (LPVOID)((DWORD)mbi.BaseAddress + dwOffset);

if( ReadProcessMemory( hProcess, mbi.BaseAddress/*lpAddress*/,
lpBuffer, lBufferSize, &dwBytesRead ) == FALSE )
{
printf("Failure 'ReadProcessMemory': %d", GetLastError());
return 1;
}

// increment lpMem to next region of memory
lpMem = (LPVOID)( (DWORD)mbi.BaseAddress + (DWORD)mbi.RegionSize );
}

return 0;
}

bool AdjustPrivileges()
{
HANDLE hToken;
TOKEN_PRIVILEGES tp;
TOKEN_PRIVILEGES oldtp;
DWORD dwSize = sizeof(TOKEN_PRIVILEGES);
LUID luid;

if (!OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &hToken))
{
if( GetLastError() == ERROR_CALL_NOT_IMPLEMENTED ) return true;
return false;
}

if( !LookupPrivilegeValue(NULL, SE_DEBUG_NAME, &luid) )
{
CloseHandle(hToken);
return false;
}

ZeroMemory(&tp, sizeof(tp));
tp.PrivilegeCount = 1;
tp.Privileges[0].Luid = luid;
tp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;

// Adjust Token Privileges
if( !AdjustTokenPrivileges (hToken, FALSE, &tp, sizeof(TOKEN_PRIVILEGES), &oldtp, &dwSize) )
{
CloseHandle(hToken);
return false;
}

// close handles
CloseHandle( hToken );

return true;
}

[vicodin451]

299 is ERROR_PARTIAL_COPY.

http://groups.google.com/groups?hl=en&lr=&ie=UTF-8&oe=UTF-8&threadm=Xns92254E6887463JochenKalmbachholzma%40127.0.0.1&rnum=2&prev=/groups%3Fsourceid%3Dnavclient%26ie%3DUTF-8%26oe%3DUTF-8%26q%3DERROR_PARTIAL_COPY

[filthy_mcnasty]

which you can 'usually' (not always) just ignore

[lior654]

wrong!!! the program crashes!!

[filthy_mcnasty]

not wrong! if the program crashes you are trying to read something that doesn't exist or isn't available to you. did you bother checking that at all? there are certain ranges reserved for the OS and other stuff. make sure that's not your problem. the base region initially is probably that lower bound reserved for the os.

start reading at lpMinimumApplicationAddress of the SYSTEM_INFO structure.