Thread: Process memory space

Hi all,

I was wondering if anyone could help me with analyzing/reading other process’ memory space. I need to view the memory space in real-time, while running the application, to be able to segregate the variables storing the application state and various strings that are displayed in UI. Then, I need to be able to locate those variables automatically and read them in real-time, whenever application is running.

For example, take Windows Media Player. I would want to be able to get variables such as: string for song currently playing, state of the player (play/pause, volume, etc.), whenever the application is running in memory. Or, as another example, a list of users currently online on MSN and their status.

Are there any applications that would ease my task (e.g. to analyze memory space first)? What programming language could this be written in? (I assume it would be C/C++, and maybe C#?) How would I go about doing all this?

Thank you very much in advance.

I am not trying to "hack" anything. First of all, I am only Reading the memory space and don't intend to Modify it at run-time. All I am trying to do is to read the information that is displayed to the user from the memory space - the text strings on the UI.

I just finished my 2nd year of CSC Major and we just covered topics such as ASM, Virtual Memory, and some C. This low level material really interests me, that is why I would like to learn how to do things like this.

While using the memory scanner on OllyDbg, I noticed that the variables are not stored consitently in memory locations, and also are duplicated in several locations. This was contrary to my belief that the variables would be stored at a consistent offset in Virtual Memory. From my knowledge I can only I guess that it all depends how the Loader loads the executable into memory? If it is inconsistent this way, is it even possible to accomplish what I am trying to do?

Are you using windows or linux? Not that its of huge consequence, but there already exist programs to aid you in finding this information.

Study up on ASM and as you learn about CPUs you will find that a lot of the common sense you'd apply to a situation goes out the window.

Originally Posted by iMalc

You're asking for information about hacking. We don't take too kindly to that here!

If the authors of a program haven't made a publicly accessible way of obtaining such information then you are out of luck as far as you should be concerned.

Come on, that's DRM-think. We all have the right to do whatever we want with our computers, including poking around in memory. Otherwise we're reduced to that Trusted Computing garbage.