Thread: How to find string in process address space with ReadProcessMemory ?

Can anyone tell me if there is something wrong with this function? I'm trying to find a string with ReadProcessMemory.

Code:

int  readMemory(DWORD pid)
{
      
 char readingBuffer[5] = {0};
 DWORD readingAddress = 0x00400000;
    HANDLE hProcess = OpenProcess(PROCESS_VM_READ, 0, pid);
           if( hProcess == INVALID_HANDLE_VALUE || hProcess == NULL )
                 MessageBox(0, "Error opening process!!!", "...",0);
            
 while(1)
 {
                Sleep(100);
                     printf("Address is : %0X \n",  readingAddress);
                                           
                    if(!ReadProcessMemory (hProcess, (LPVOID)readingAddress, &readingBuffer, sizeof(readingBuffer), NULL))
                    {
                        MessageBox(0, "Error reading memory!!!", "...",0);
                        return 1;
                    }
                    if (!_stricmp(readingBuffer, "http")==0)
                    {
                        MessageBox(0, "String found!", "...",0);
                        return 2;
                    }
                    readingAddress += sizeof(readingBuffer);
    
 }     
     
         
    return 0;
}

You're reading into all 5 bytes of readingbuffer, but when you use _stricmp you're assuming a zero-terminated string. You should only read sizeof(readingBuffer)-1 at a time.

Also, you should probably increment readingAddress by 1.