Question

first time posting here after having so many of my Google results come up from this wonderful site.

Basically, I’d like to find the name of the variable stored at a particular memory address. I have a memory editing application I wrote that edits a single value, the problem being that every time the application holding this value is patched, I have to hardcode in the new memory address into my application, and recompile, which takes so much time to upkeep that its almost not worthwhile to do.

What I’d like to do is grab the name of the variable stored at a certain memory address, that way I can then find its address at runtime and use that as the memory address to edit.

This is all being written in C++.

Thanks in advance!

Edit:

Well I’ve decided I’d like to stream the data from a .txt file, but I’m not sure how to convert the string into an LPVOID for use as the memory address in WriteProcessMemory(). This is what I’ve tried:

    string fileContents;

    ifstream memFile("mem_address.txt");
        getline(memFile, fileContents);
    memFile.close();

    LPVOID memAddress = (LPVOID)fileContents.c_str();

    //Lots of code..

    WriteProcessMemory(WindowsProcessHandle, memAddress, &BytesToBeWrote, sizeof(BytesToBeWrote), &NumBytesWrote);

The code is all correct in terms of syntax, it compiles and runs, but the WriteProcessMemory errors and I can only imagine it has to do with my faulty LPVOID variable. I apologize if extending the use of my question is against the rules, I’ll remove my edit if it is.

Answer 1

Compile and generate a so called map file. This can be done easily with Visual-C++ (/MAP linker option). There you’ll see the symbols (functions, …) with their starting address. Using this map file (Caution: has to be updated each time you recompile) you can match the addresses to names.

This is actually not so easy because the addresses are relative to the preferred load address, and probably will (randomization) be different from the actual load address.

Some old hints on retrieving the right address can be found here: http://home.hiwaay.net/~georgech/WhitePapers/MapFiles/MapFiles.htm