Thread: Segmentation fault!?!?!?

p.s. Why the hell aren't PSAPI_WORKING_SET_INFORMATION and PSAPI_WORKING_SET_BLOCK declared in psapi.h like they should've been

They're found in the really old SDK's (pre 2000 SDK's). Bottomline, is that they're now considered obsolete. So, you won't find them in the current Windows Server 2003 SDK. It appears that MS now wants you to repeatedly call QueryWorkingSet to dynamically allocate the correct storage for a PVOID to hold your information. I'll have to write some POC code to verify this.

I think we've been going about this in the wrong way. The documented functions for querying and walking used memory only give back a subset of the total memory a process has access to. The working set doesn't necessarily contain all referenceable memory, likewise allocated memory doesn't have to come from a heap. Since there doesn't seem to be a public way to access the address and extents of just which vm regions are valid (short of VirtualQueryExing every page), the dump and inspect method isn't viable for total coverage.

I thought of minidumping the process which can bring in all allocated memory, and querying the dump file for info but that obviously wouldn't scale very well, and there's a snag in that the dmp file doesn't seem to be (well) documented. Searching for the format lead me to this, and the idea of leveraging the same interfaces as WinDbg, which just happens to contain a method that can search for an arbitrary value in a specified virtual memory range of an attached process.

I tested this with cmd.exe and it returned where the MZ dos header was for all loaded modules so it seems to work well for small values at least. I'm not saying this is the best method, but it seems a more complete and simpler method to use and build upon than the enumeration of pages and heap block approaches. With the immediate downside being that it won't work on Win2k as-is due to the use of DebugBreakProcess to trigger the initial debug event.

I got the impression that the OP is simply looking for a certain value in memory and not specifically to dump it. If dumping is what's required, you can use the same framework, just dump the process with MiniDumpWriteDump and change
pClient->AttachProcess
to
pClient->OpenDumpFile(dumpfile)

Anyway, enough rambling.

Code:

#define _WIN32_WINNT 0x0501
#include <windows.h>
#include <objbase.h>
#include <dbghelp.h>
#include <dbgeng.h>
#include <iostream>

struct ThreadParams
{
    HANDLE hProc;
    IDebugControl* control;
};

BOOL SetProcessPrivilege(HANDLE hProcess, LPCTSTR lpszPrivilege, BOOL bEnablePrivilege)
{
    HANDLE hToken = NULL;
    BOOL retVal = FALSE;

    if(OpenProcessToken(hProcess, TOKEN_ADJUST_PRIVILEGES, &hToken))
    {
        LUID luid;
        if (LookupPrivilegeValue(NULL, lpszPrivilege, &luid))
        {
            TOKEN_PRIVILEGES tp;
            tp.PrivilegeCount = 1;
            tp.Privileges[0].Luid = luid;
            if (bEnablePrivilege)
            {
                tp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
            }
            else
            {
                tp.Privileges[0].Attributes = 0;
            }
            if (AdjustTokenPrivileges(
                hToken, 
                FALSE, 
                &tp, 
                sizeof(TOKEN_PRIVILEGES), 
                (PTOKEN_PRIVILEGES) NULL, 
                (PDWORD) NULL) && (GetLastError() != ERROR_NOT_ALL_ASSIGNED))
            {
                retVal = TRUE;
            }
        }
        CloseHandle(hToken);
    }
    return retVal;
}

void ResumeBrokenProcess(IDebugControl* pCont)
{
    // "g" is the windbg command for continuing from break
    pCont->Execute(DEBUG_OUTCTL_THIS_CLIENT, "g", DEBUG_EXECUTE_NOT_LOGGED);
}

// Thread function that will trigger a debug event in the attached process
// A seperate thread is required since WaitForEvent blocks, and none
// of the debugging functionality works until it has completed
DWORD WINAPI CauseWaitForEventToComplete(LPVOID param)
{
    Sleep(1000);
    ThreadParams* tp = (ThreadParams*)param;
    DebugBreakProcess(tp->hProc);
    ResumeBrokenProcess(tp->control);
    return 0;
}

int main()
{
    SetProcessPrivilege(GetCurrentProcess(), SE_DEBUG_NAME, TRUE);
    CoInitialize(NULL);
    IDebugClient* pClient = NULL;
    if(SUCCEEDED(DebugCreate(IID_IDebugClient, reinterpret_cast<PVOID*>(&pClient))))
    {
        ULONG procId = 0;
        IDebugControl* pControl = NULL;
        // change exe name to desired process
        pClient->GetRunningProcessSystemIdByExecutableName(0, "cmd.exe", 0, &procId);
        HANDLE hProc = OpenProcess(GENERIC_WRITE, 0, procId);
        if(SUCCEEDED(DebugCreate(
            IID_IDebugControl,
            reinterpret_cast<PVOID*>(&pControl)))
            )
        {
            if(SUCCEEDED(pClient->AttachProcess(0, procId, DEBUG_ATTACH_DEFAULT)))
            {
                ThreadParams tp = {0};
                tp.hProc = hProc;
                tp.control = pControl;
                CloseHandle(CreateThread(NULL, 0, &CauseWaitForEventToComplete, &tp, 0, NULL));
                // have to do this otherwise we won't be fully attached to the process
                pControl->WaitForEvent(DEBUG_WAIT_DEFAULT, INFINITE);
                IDebugDataSpaces* pDSpace = NULL;

                if(SUCCEEDED(pClient->QueryInterface(
                    IID_IDebugDataSpaces, 
                    reinterpret_cast<PVOID*>(&pDSpace)))
                    )
                {
                    // search for the "MZ" signature as an example
                    WORD imageHeader = IMAGE_DOS_SIGNATURE;
                    SYSTEM_INFO inf = {0};
                    GetSystemInfo(&inf);
                    // search the entire user address range
                    const ULONG64 maxAddress = reinterpret_cast<ULONG64>(inf.lpMaximumApplicationAddress);
                    ULONG64 startingOffset = reinterpret_cast<ULONG64>(inf.lpMinimumApplicationAddress);
                    ULONG64 bytesToSearch = maxAddress - startingOffset;
                    // suspending the process would probably be better for a "true" snapshot
                    // but that requires faffing with undocumented functions
                    DebugBreakProcess(hProc);
                    while(pDSpace->SearchVirtual(
                        startingOffset, bytesToSearch, &imageHeader,
                        sizeof(imageHeader), 2, &startingOffset)
                        == S_OK)
                    {
                        // LOBYTE and HIBYTE used just so cout outputs the MZ characters
                        std::cout << "Pattern " << LOBYTE(imageHeader) << HIBYTE(imageHeader) 
                                  << " found at 0x" << reinterpret_cast<PVOID>(startingOffset)
                                  << '\n';
                        startingOffset += 2;
                        bytesToSearch = maxAddress - startingOffset;
                    }
                    ResumeBrokenProcess(pControl);
                    pDSpace->Release();
                }
                pControl->Release();
            }
            pClient->DetachProcesses();
            pClient->Release();
        }
        CloseHandle(hProc);
    }
    CoUninitialize();
    return 0;
}

Originally Posted by adeyblue

I think we've been going about this in the wrong way. The documented functions for querying and walking used memory only give back a subset of the total memory a process has access to. The working set doesn't necessarily contain all referenceable memory, likewise allocated memory doesn't have to come from a heap. Since there doesn't seem to be a public way to access the address and extents of just which vm regions are valid (short of VirtualQueryExing every page), the dump and inspect method isn't viable for total coverage.

I thought of minidumping the process which can bring in all allocated memory, and querying the dump file for info but that obviously wouldn't scale very well, and there's a snag in that the dmp file doesn't seem to be (well) documented. Searching for the format lead me to this, and the idea of leveraging the same interfaces as WinDbg, which just happens to contain a method that can search for an arbitrary value in a specified virtual memory range of an attached process.

I tested this with cmd.exe and it returned where the MZ dos header was for all loaded modules so it seems to work well for small values at least. I'm not saying this is the best method, but it seems a more complete and simpler method to use and build upon than the enumeration of pages and heap block approaches. With the immediate downside being that it won't work on Win2k as-is due to the use of DebugBreakProcess to trigger the initial debug event.

I got the impression that the OP is simply looking for a certain value in memory and not specifically to dump it. If dumping is what's required, you can use the same framework, just dump the process with MiniDumpWriteDump and change
pClient->AttachProcess
to
pClient->OpenDumpFile(dumpfile)

Anyway, enough rambling.

I keep saying it, but I'll say it again: I need a dump of the whole thing, not just a way to search a single value. Has nobody here ever used any type of cheat searching program? In most cases, I compare multiple dumps to find an unknown value controlling something (i.e. health bar). Anyway, I don't understand hardly any of what that's doing and it seems like a lot of odd stuff. I also don't entirely see how MiniDumpWriteDump would work, but it sounds promising.


Bob - Most of that was in matsp's C++ example. I'm now sure what you were trying to show me. If I could sort that list of pages, it might be workable, but reading 4k chunks in random order without an easy way to keep track of what's where when loading a copy of the dump later doesn't help much. Reading pages just seems insane, IMO. I guess I could loop it that way if I have to. I'd just have to keep reallocating the dump array or write direct to a file as binary. Still seems like it'd take a lot longer than other search programs though.

Edit: I posted on gamehacking.com as well. The only response I got so far was simply to "research VirtualQueryEx", and that was from the guy that wrote MHS. I guess I'll have to try to make that work. I was really hoping someone would know a better way. Whoever wrote the example here (matsp?) used QueryWorkingSet, but I don't remember seeing VirtualQueryEx. I"m not sure how it works or what I actually need from it though. It expects a hanlde and an address. I'm guessing the address comes from QueryWorkingSet? Do I use VirtualQueryEx to determine which pages are actually in use? MEM_COMMIT?

Originally Posted by BobS0327

But anyway take a look at this old post. If it looks promising to you we can pursue it further.

Hmmmm. Looks like it's doing the same general thing, just using a different method. Instead of obtaining a list of pages, it appears to get the max address and work its way to there getting entire blocks of similar pages. This does indeed look promising. I don't entirely understand or see the need for VirtualAlloc or the extra struct info in my case though. Why the MEMORYOBJECT struct containing the MEMORY_BASIC_INFORMATION struct?

Edit: Ok, I'm making some progress, hopefully. This seems to be dumping everything I would need from a process, but it also seems to be dumping some extra (useless) data (shared pages?). I noticed the file begins with a bunch of data about the user profile, computer name, etc. I'm wondering if I should be checking for only the memory that's not shared (MEM_PRIVATE) ? In theory, I could also knock off the region of the main module (and others?) so that I only get allocated data and not executable code, unless I want it.

Code:

    FILE *DumpFile = fopen(DumpName, "wb");
    if (!(DumpFile)) {
        sprintf(ErrTxt, "Unable to open dump file (DumpRAM,1) -- Error %u", GetLastError());
        MessageBox(NULL, ErrTxt, "Error", MB_OK);
        return 0;
    }
    fseek(DumpFile,0,SEEK_SET);

    MEMORY_BASIC_INFORMATION memInfo; memset(&memInfo,0,sizeof(MEMORY_BASIC_INFORMATION));
    SYSTEM_INFO sysInfo;
    GetSystemInfo(&sysInfo);
    VOID* address = 0;
    while (address < sysInfo.lpMaximumApplicationAddress)
    {
	VirtualQueryEx(HookedProcess.hProcess, address, &memInfo, sizeof(MEMORY_BASIC_INFORMATION));
        address = memInfo.BaseAddress + memInfo.RegionSize;
        if (memInfo.State != 0x1000) { continue; }

        if (buffer) { free(buffer); buffer = NULL; }
        if (!(buffer = (unsigned char*)malloc((DWORD)memInfo.RegionSize+1))) {
            sprintf(ErrTxt, "Unable to allocate buffer memory (DumpRAM, 1) -- Error %u", GetLastError());
            MessageBox(NULL, ErrTxt, "Error", MB_OK);
            return 0;
        }

        if (ReadProcessMemory(HookedProcess.hProcess, memInfo.BaseAddress, buffer, memInfo.RegionSize, &bytesread) == 0) {
                //fail
        }
        fwrite(buffer,1,memInfo.RegionSize,DumpFile);
    }
    free(buffer); buffer = NULL;
    fclose(DumpFile);

Edit: Ok, I'm making some progress, hopefully. This seems to be dumping everything I would need from a process, but it also seems to be dumping some extra (useless) data (shared pages?). I noticed the file begins with a bunch of data about the user profile, computer name, etc. I'm wondering if I should be checking for only the memory that's not shared (MEM_PRIVATE) ? In theory, I could also knock off the region of the main module (and others?) so that I only get allocated data and not executable code, unless I want it.

You don't have to check memory whose STATE is either FREE or RESERVED.

EDIT: I noticed a potential problem in my old code post. Try the following change:

change this:

Code:

VOID *address = 0;
    while (address < sysInfo.lpMaximumApplicationAddress)
    {

to this:

Code:

VOID *address = sysInfo.lpMinimumApplicationAddress
   while (address < sysInfo.lpMaximumApplicationAddress)

Second EDIT:

If the type of memory is MEM_PRIVATE and the state of memory is MEM_COMMIT, then this memory is worth checking out.

Good stuff, but I still have 2 problems:

1. It's not actually dumping memory. 299 error every time.
2. Attempting to dump a process seems to instantly double its memory usage for some reason.

Code:

    FILE *DumpFile = fopen(DumpName, "wb");
    if (!(DumpFile)) {
        sprintf(ErrTxt, "Unable to open dump file (DumpRAM,1) -- Error %u", GetLastError());
        MessageBox(NULL, ErrTxt, "Error", MB_OK);
        return 0;
    }
    fseek(DumpFile,0,SEEK_SET);

    MEMORY_BASIC_INFORMATION memInfo; memset(&memInfo,0,sizeof(MEMORY_BASIC_INFORMATION));
    SYSTEM_INFO sysInfo;
    GetSystemInfo(&sysInfo);
    VOID* address = sysInfo.lpMinimumApplicationAddress;
    while (address < sysInfo.lpMaximumApplicationAddress)
	{
		VirtualQueryEx(HookedProcess.hProcess, address, &memInfo, sizeof(MEMORY_BASIC_INFORMATION));
        address = memInfo.BaseAddress + memInfo.RegionSize;
		if (memInfo.State != MEM_COMMIT) { continue; }
		if (memInfo.Type != MEM_PRIVATE) { continue; }

        if (buffer) { free(buffer); buffer = NULL; }
        if (!(buffer = (unsigned char*)malloc((DWORD)memInfo.RegionSize+1))) {
            sprintf(ErrTxt, "Unable to allocate buffer memory (DumpRAM, 1) -- Error %u", GetLastError());
            MessageBox(NULL, ErrTxt, "Error", MB_OK);
            return 0;
        }

        if (ReadProcessMemory(HookedProcess.hProcess, memInfo.BaseAddress, buffer, memInfo.RegionSize, &bytesread) == 0) {
                //fail
            sprintf(ErrTxt, "Unable to dump RAM from process (DumpRAM, 1) -- Error %u", GetLastError());
            MessageBox(NULL, ErrTxt, "Error", MB_OK);
            free(buffer); buffer = NULL;
            fclose(DumpFile);
            return 0;
        }
        fwrite(buffer,1,memInfo.RegionSize,DumpFile);
        filesize += memInfo.RegionSize;
	}
	free(buffer); buffer = NULL;
    fclose(DumpFile);

I thought the modules were only the executable and that method didn't retrieve all the random memory allocated by the game/whatever. We tried that exact method earlier in this thread, didn't we? How bout telling me why our previous idea isn't working the way I wrote it.

Edit: The guy on gamehacking.com shared a snippet. Looks like the same thing I was attempting except it checks a different element of the MBI.

Code:

 HANDLE hProcess = GetCurrentProcess(); // or however you get your process handle.

    DWORD Address = 0x10000;  // The first user-land address.

    MEMORY_BASIC_INFORMATION mbi;

    VirtualQueryEx(hProcess, (PVOID)Address, &mbi, sizeof(mbi));

    do

    {

        if (mbi.State != MEM_FREE)

        {

            DWORD page_attr = PAGE_READWRITE | PAGE_WRITECOPY | PAGE_EXECUTE_READWRITE | PAGE_EXECUTE_WRITECOPY;

            if (mbi.Protect & page_attr)

            {

                // Do something here.  Export to a file.

                printf("ADDRESS -> 0x%.8X\n\r", mbi.BaseAddress);

            };

        };

        Address += mbi.RegionSize;

    } while(VirtualQueryEx(hProcess, (PVOID)Address, &mbi, sizeof(mbi)));

-----------------------------

Edit 2: I can't figure out what I'm doing wrong here.
Edit 3: Ok, I might be getting somewhere. Is it possible to bypass PAGE_GUARD protection on a page? I still have that token privilege thing being called, but it doesn't appear to solve this. Also, I'd still swear the process grows in size greatly the instant I dump with this.

p.s. Why the hell is there a page in the process with windows user profile and environment variables. I don't think that block will be very useful for my purposes. lol

Code:

    FILE *DumpFile = fopen(DumpName, "wb");
    if (!(DumpFile)) {
        sprintf(ErrTxt, "Unable to open dump file (DumpRAM,1) -- Error %u", GetLastError());
        MessageBox(NULL, ErrTxt, "Error", MB_OK);
        return 0;
    }
    fseek(DumpFile,0,SEEK_SET);

    MEMORY_BASIC_INFORMATION memInfo; memset(&memInfo,0,sizeof(MEMORY_BASIC_INFORMATION));
    SYSTEM_INFO sysInfo;
    GetSystemInfo(&sysInfo);
    VOID* address = sysInfo.lpMinimumApplicationAddress;
    while (address < sysInfo.lpMaximumApplicationAddress)
	{
		VirtualQueryEx(HookedProcess.hProcess, address, &memInfo, sizeof(MEMORY_BASIC_INFORMATION));
        address = memInfo.BaseAddress + memInfo.RegionSize;
//		if (memInfo.State != MEM_COMMIT) { continue; }
//		if (memInfo.Type != MEM_PRIVATE) { continue; }
		if (memInfo.State == MEM_FREE) { continue; }
		if ((memInfo.Protect & (PAGE_READWRITE|PAGE_WRITECOPY|PAGE_EXECUTE_READWRITE|PAGE_EXECUTE_WRITECOPY)) == 0) { continue; }
		if (memInfo.Protect & (PAGE_NOACCESS|PAGE_READONLY|PAGE_EXECUTE|PAGE_EXECUTE_READ|PAGE_GUARD)) { continue; }

        if (buffer) { free(buffer); buffer = NULL; }
        if (!(buffer = (unsigned char*)malloc((DWORD)memInfo.RegionSize+1))) {
            sprintf(ErrTxt, "Unable to allocate buffer memory (DumpRAM, 1) -- Error %u", GetLastError());
            MessageBox(NULL, ErrTxt, "Error", MB_OK);
            return 0;
        }

        if (ReadProcessMemory(HookedProcess.hProcess, memInfo.BaseAddress, buffer, memInfo.RegionSize, &bytesread) == 0) {
                //fail
            sprintf(ErrTxt, "Unable to dump RAM from process (DumpRAM, 2) -- Error %u\nAddress: %08X\nRegion Size: %X\nProtection: %X\n State: %X, Type: %X", GetLastError(), memInfo.BaseAddress, memInfo.RegionSize, memInfo.Protect, memInfo.State, memInfo.Type);
            MessageBox(NULL, ErrTxt, "Error", MB_OK);
            free(buffer); buffer = NULL;
            fclose(DumpFile);
            return 0;
        }
        fwrite(buffer,1,memInfo.RegionSize,DumpFile);
        filesize += memInfo.RegionSize;
	}
	free(buffer); buffer = NULL;
    fclose(DumpFile);

Code:

int InitHook()
{
    if ( !EnableTokenPrivilege (SE_DEBUG_NAME) )
    {
        MessageBox(NULL, "Cannot get required privilege", "Error", MB_OK);
        return 1;
    }
    HookedProcess.hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, HookedProcess.dwProcessId);
    char txtTitle[100];
    strcpy(txtTitle,PROGRAM_NAME); strcat(txtTitle," - ");
    strcat(txtTitle,Settings.Hook.FileName);
    SetWindowText(hwndMain,txtTitle);
    return 0;
}

BOOL EnableTokenPrivilege (LPTSTR privilege)
{
    HANDLE hToken;
    TOKEN_PRIVILEGES token_privileges;
    DWORD dwSize;
    ZeroMemory (&token_privileges, sizeof (token_privileges));
    token_privileges.PrivilegeCount = 1;
    if ( !OpenProcessToken (GetCurrentProcess(), TOKEN_ALL_ACCESS, &hToken))
        return FALSE;
    if (!LookupPrivilegeValue ( NULL, privilege, &token_privileges.Privileges[0].Luid))
    {
        CloseHandle (hToken);
        return FALSE;
    }

    token_privileges.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
    if (!AdjustTokenPrivileges ( hToken, FALSE, &token_privileges, 0, NULL, &dwSize))
    {
        CloseHandle (hToken);
        return FALSE;
    }
    CloseHandle (hToken);
    return TRUE;
}