Question

Could someone please help me, I do not know why the ReadProcessMemory function fails and GetLastError = 299. Here is my code, I can’t see that im doing anything wrong.

if(ReadProcessMemory(hProcess, (void*)0, IDH_Buffer, sizeof(IMAGE_DOS_HEADER), 0) != true)
        std::cout << "Failed to read from Process, GLE=" << GetLastError()  << "\n";

IDH_Buffer has be assigned, hProcess is non NULL

My App is running as Admin and the app that im trying to read from is a standard usermode application.

Please could you advise me.
Thanks

Answer 1

Quoting from MSDN on Win32 error codes:

ERROR_PARTIAL_COPY
299 (0x12B)
Only part of a ReadProcessMemory or WriteProcessMemory request was completed.

My guess is the address you specified contained some valid data, but somewhere between that address and (address + length of copy), there was no memory mapped.

See wikipedia on page table or virtual memory to understand a bit more about how an operating system establishes an address space. In that parlance, somewhere in that memory range there was a page table entry that was not valid.

Actually, looking at your code… It’s obvious that this won’t work. The BaseAddress parameter is zero. You’re trying to dereference a NULL pointer in the other process’s address space. If the target process itself tried to pull this, it would crash. 🙂 The EXE’s header is not mapped to address 0. If you are trying to read from the EXE file itself, I would suggest simply calling CreateFile on a path obtained by GetModuleFileNameEx.