C# Read/Write another Process' Memory ZZ

Today's tutorial is about...processes' memory! In this article I'll show you how to read/write a process' memory using C#. This is a good way to learn a part of WinAPI and also understand the basics of memory allocation.


Before starting, we need a "target" - I choose notepad.exe.

1.Finding the Memory Address

As you might probably know, applications store each variable's value at a specific memory address, we need to know that memory adress in order to edit anything. Since there's not other way around (or I'm not aware of it?) the only solution is to start searching, using a debugger.

To get that memory address, I used OllyDbg - don't worry, all the steps are written below.

First, open notepad.exe, type some text (like "hello world") and attach OllyDbg (File->Attach). Press F9 and then ALT+M to open the Memory Map.

It should look like this:



 

Press CTRL+B and it will open the Binary Search Window. Now, because the value is stored in memory as Unicode, you have to type the string you're looking for in the 2nd textbox:



 

Once you hit Ok another window will pop up - the Memory Dump. Here, look at the very first memory address (on the left) - from that address we'll start reading. In the image below, the highlighted part contains the message I typed in Notepad.

Note: don't use the memory address from the image - it's not the same memory address every time



 

We got the memory address, now...don't close/restart the application. If you restart it, the memory for the text will be reallocated, so the address will most likely be changed.
 

2.Read Process' Memory

In order to read the value from that memory address, we need to import 2 functions into C#: OpenProcess() and ReadProcessMemory() from kernel32.dll.

1. [DllImport("kernel32.dll")]
2. public static extern IntPtr OpenProcess(int dwDesiredAccess, bool bInheritHandle, int dwProcessId);
4. [DllImport("kernel32.dll")]
5. public static extern bool ReadProcessMemory(int hProcess, int lpBaseAddress, byte[] lpBuffer, int dwSize, ref int lpNumberOfBytesRead);

When a process is opened, you must also specify the desired access (this time, you request access for reading the memory), so this constant is needed:

1. const int PROCESS_WM_READ = 0x0010;

Since the whole code is self explanatory, I'll just add short comments where they're needed:

1. using System;
2. using System.Diagnostics;
3. using System.Runtime.InteropServices;
4. using System.Text;
6. public class MemoryRead
7. {
8. const int PROCESS_WM_READ = 0x0010;
10. [DllImport("kernel32.dll")]
11. public static extern IntPtr OpenProcess(int dwDesiredAccess, bool bInheritHandle, int dwProcessId);
13. [DllImport("kernel32.dll")]
14. public static extern bool ReadProcessMemory(int hProcess, int lpBaseAddress, byte[] lpBuffer, int dwSize, ref int lpNumberOfBytesRead);
18. public static void Main()
19. {
21. Process process = Process.GetProcessesByName("notepad")[0];
22. IntPtr processHandle = OpenProcess(PROCESS_WM_READ, false, process.Id);
24. int bytesRead = 0;
25. byte[] buffer = new byte[24]; //'Hello World!' takes 12*2 bytes because of Unicode
27. // 0x0046A3B8 is the address where I found the string, replace it with what you found
28. ReadProcessMemory((int)processHandle, 0x0046A3B8, buffer, buffer.Length, ref bytesRead);
30. Console.WriteLine(Encoding.Unicode.GetString(buffer) + " (" + bytesRead.ToString() + "bytes)");
31. Console.ReadLine();
32. }
33. }

 

3.Write Process' Memory

Writing to a memory address is a little bit different: you'll need OpenProcess() and WriteProcessMemory().

1. [DllImport("kernel32.dll")]
2. public static extern IntPtr OpenProcess(int dwDesiredAccess, bool bInheritHandle, int dwProcessId);
4. [DllImport("kernel32.dll", SetLastError = true)]
5. static extern bool WriteProcessMemory(int hProcess, int lpBaseAddress, byte[] lpBuffer, int dwSize, ref int lpNumberOfBytesWritten);

However, special permissions are required: while opening the process request the following access: PROCESS_VM_WRITE | PROCESS_VM_OPERATION.

1. const int PROCESS_VM_WRITE = 0x0020;
2. const int PROCESS_VM_OPERATION = 0x0008;

Note: notepad's textbox is storing the number of bytes it has to read from the memory - that value is updated only when the text is changed by user. If you write to the memory address a longer string, it will be truncated.

The complete code is available below:

1. using System;
2. using System.Diagnostics;
3. using System.Runtime.InteropServices;
4. using System.Text;
6. public class MemoryRead
7. {
8. const int PROCESS_VM_WRITE = 0x0020;
9. const int PROCESS_VM_OPERATION = 0x0008;
11. [DllImport("kernel32.dll")]
12. public static extern IntPtr OpenProcess(int dwDesiredAccess, bool bInheritHandle, int dwProcessId);
14. [DllImport("kernel32.dll", SetLastError = true)]
15. static extern bool WriteProcessMemory(int hProcess, int lpBaseAddress, byte[] lpBuffer, int dwSize, ref int lpNumberOfBytesWritten);
19. public static void Main()
20. {
22. Process process = Process.GetProcessesByName("notepad")[0];
23. IntPtr processHandle = OpenProcess(0x1F0FFF, false, process.Id);
25. int bytesWritten = 0;
26. byte[] buffer = Encoding.Unicode.GetBytes("It works!"); // '' marks the end of string
28. // replace 0x0046A3B8 with your address
29. WriteProcessMemory((int)processHandle, 0x0046A3B8, buffer, buffer.Length, ref bytesWritten);
30. Console.ReadLine();
31. }
32. }