Question about using memcmp ()

**Vortex** · 06-03-2006

Hi,

I do try to write a function like this one:
This is only a sample - I don't post the whole code, because it will be useless info:

Code:

BYTE *bBuffer = 0;

bBuffer = (LPBYTE)GlobalAlloc(GMEM_FIXED, ModInfo.SizeOfImage+1);//allocating of memory

ReadProcessMemory(hProcess, ModInfo.lpBaseOfDll, bBuffer, ModInfo.SizeOfImage, &cbRead);

for( i = 0; i < ModInfo.SizeOfImage; i++)
if (!memcmp(&bBuffer[i], bPattern, 10))// we have a match
 {	
								
// we calculate lpBaseOfDll (beginning addr. of executable module +  i)

DWORD dwPatchAddress = (DWORD)ModInfo.lpBaseOfDll + i;
// we replace
WriteProcessMemory(hProcess, (LPVOID)dwPatchAddress, LPVOID(szReplaceBytes), 10, &cbRead);
CloseHandle(hProcess);
MessageBox(NULL,"Done!","OK",MB_OK|MB_ICONINFORMATION);
break;
}

Normally I need to include a condition if there is no match with bPattern : MessageBox(something) -> break;
but when I write such - I get it always even if there is a match with bPattern and I don't understand why..
Does anyone of you have an idea how to make it work...?

**dwks** · 06-03-2006

You mean that this

Code:

if (!memcmp(&bBuffer[i], bPattern, 10))// we have a match

is always true?

[edit]
Perhaps the data is always the same, because you seem to be using memcmp() correctly: http://www.cprogramming.com/fod/memcmp.html
[/edit]

**Vortex** · 06-03-2006

Hi dwks,
I am not sure what you mean - the way it is written, this code always does do the job...

Code:

if (!memcmp(&bBuffer[i], bPattern, 10))// we have a match

of course it could be written like this:

Code:

int result;
result=(memcmp(&bBuffer[i], bPattern, 10));
if (result==0) //which means that we have a match here
{
(...)
}
if (result >0 || result <0) //there is no match 
{
(...)
}

The problem is that condition number 2 is what I run into even if there is a match.

**dwks** · 06-03-2006

The problem is that condition number 2 is what I run into even if there is a match.

Well then you must not be passing memcmp() the right values. (Either that or there wasn't really a match. Perhaps there is a discreprency in the first 10 bytes of data?)

**Vortex** · 06-03-2006

Well then you must not be passing memcmp() the right values. (Either that or there wasn't really a match. Perhaps there is a discreprency in the first 10 bytes of data?)

Ah, well
I suppose that my problems start somewhere here:

Code:

for( i = 0; i < ModInfo.SizeOfImage; i++)

while counting ...condition number 2 is always true, unless the address where the bytes do match is reached... So I need maybe to extend it somehow... Many thanks for your replies.

**dwks** · 06-03-2006

Why don't you print (or pop up a message box with) the values of the data before you compare them? Then you can see if they really match.

Or just fire up your debugger.

Thread: Question about using memcmp ()

Thread Tools

Search Thread

Display

Question about using memcmp ()

Similar Threads

Alice....

Debugging question

Question about pointers #2

Question...

Question, question!