Checking memory allocation

JoeBloggs · 12-09-2008, 01:53 AM

Okay, so I'm basically writing a c .dll that will iterate through memory of the target process and report if a certain value is true.

I have this working fine (through the use of pointers), however, when it hits region of memory that hasn't been allocated it crashes the process. I was looking for a method (preferably not through Windows API) to check whether or not the memory has being allocated.

Code looks something like this:

Code:

for(i=0x10000;i<0x7FFFFFFF;i+=0x10000)
{
			
	if(*(DWORD*)(i + 0xAC) == 0x16945630)
	{
		pdwMyAddr = (DWORD*)(i + 0xAC);
		//Abritrary code here.
	}
}

Thanks for any help

.

C_ntua · 12-09-2008, 02:28 AM

Well, it crashes as it owes to. I suppose you have a method to know exactly which memory address the process owns? Like from where the heap, the stack etc etc start end.
Well, the information is somewhere, but that depends on the OS. The OS is responsible for managing memory along processes. But I don't know where you can read that information. The sure think is that it would be TOTALLY unsafe if somebody could just read information from the memory without being owned by the process.
It would be also unsafe to find out where a process writes and just read that memory!
And finally, every time the process runs it won't have the same memory space. It would depend.
Now, if you have access to the code of the program it might be possible. You could probably just print the address of each variable, manually or with a certain function maybe? Then finding the "bounds" of the memory owned by the process you might get what you want. Probably not what you want 'cause I don't believe its possible for security reasons...

zacs7 · 12-09-2008, 02:43 AM

The days when such a thing was possible are long, long gone.

Basically you need to inject a DLL into the target process and then read the memory of the process via that DLL. I won't say anymore just incase it's against the rules (this sort of stuff is used by viruses and game cheats).

JoeBloggs · 12-09-2008, 03:04 AM

Quote:

The sure think is that it would be TOTALLY unsafe if somebody could just read information from the memory without being owned by the process.

My dll creates a thread belonging to the process.

Quote:

And finally, every time the process runs it won't have the same memory space. It would depend.

Yep, I am aware of that, this function is for finding the address of a value within memory

Quote:

Basically you need to inject a DLL into the target process and then read the memory of the process via that DLL. I won't say anymore just incase it's against the rules (this sort of stuff is used by viruses and game cheats).

Yep, yep everything is working, other than when it hits a block of unallocated memory it crashes (as it is attempting to assign it to a DWORD, when there's nothing there)

Quote:

And finally, every time the process runs it won't have the same memory space. It would depend.

Oh, ohk, so I will have to resort to an api to check? :[.

Thanks for the quick replies

Elysia · 12-09-2008, 04:25 AM

Yes, you may want to look into the Virtual Memory functions of the Win32 API, more specifically VirtualQuery. Use it to query if the pages have been allocated or not.
But then again, why do you need to do this?

matsp · 12-09-2008, 05:01 AM

There was a discussion not so long ago, where we came up with a list of "Possible virtual addresses that the process may own".

--
Mats

12-09-2008, 01:53 AM	#1
JoeBloggs Registered User Join Date: Dec 2008 Posts: 3	Checking memory allocation Okay, so I'm basically writing a c .dll that will iterate through memory of the target process and report if a certain value is true. I have this working fine (through the use of pointers), however, when it hits region of memory that hasn't been allocated it crashes the process. I was looking for a method (preferably not through Windows API) to check whether or not the memory has being allocated. Code looks something like this: Code: for(i=0x10000;i<0x7FFFFFFF;i+=0x10000) { if((DWORD)(i + 0xAC) == 0x16945630) { pdwMyAddr = (DWORD*)(i + 0xAC); //Abritrary code here. } } Thanks for any help .
JoeBloggs is offline

12-09-2008, 02:28 AM	#2
C_ntua Registered User Join Date: Jun 2008 Posts: 1,134	Well, it crashes as it owes to. I suppose you have a method to know exactly which memory address the process owns? Like from where the heap, the stack etc etc start end. Well, the information is somewhere, but that depends on the OS. The OS is responsible for managing memory along processes. But I don't know where you can read that information. The sure think is that it would be TOTALLY unsafe if somebody could just read information from the memory without being owned by the process. It would be also unsafe to find out where a process writes and just read that memory! And finally, every time the process runs it won't have the same memory space. It would depend. Now, if you have access to the code of the program it might be possible. You could probably just print the address of each variable, manually or with a certain function maybe? Then finding the "bounds" of the memory owned by the process you might get what you want. Probably not what you want 'cause I don't believe its possible for security reasons...
C_ntua is offline

12-09-2008, 02:43 AM	#3
zacs7 Woof, woof! Join Date: Mar 2007 Location: Australia Posts: 3,139	The days when such a thing was possible are long, long gone. Basically you need to inject a DLL into the target process and then read the memory of the process via that DLL. I won't say anymore just incase it's against the rules (this sort of stuff is used by viruses and game cheats). __________________ "I.T. gets the chicky-babes" - M. Kelly bakefile \| vim
zacs7 is offline

12-09-2008, 05:01 AM	#6
matsp Kernel hacker Join Date: Jul 2007 Location: Farncombe, Surrey, England Posts: 15,686	There was a discussion not so long ago, where we came up with a list of "Possible virtual addresses that the process may own". -- Mats __________________ Compilers can produce warnings - make the compiler programmers happy: Use them! Please don't PM me for help - and no, I don't do help over instant messengers.
matsp is offline

Thread Tools
Show Printable Version Email this Page
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
POSIX Threads and dynamic memory allocation	PING	Linux Programming	1	04-02-2009 10:28 AM
To find the memory leaks without using any tools	asadullah	C Programming	2	05-12-2008 07:54 AM
Assignment Operator, Memory and Scope	SevenThunders	C++ Programming	47	03-31-2008 06:22 AM
Checking for memory allocation...	kinghajj	C Programming	7	12-22-2004 10:42 PM
Memory allocation at runtime?	electrolove	C Programming	6	02-05-2003 11:39 AM