Question

I have a function like this:

int __stdcall sub_57BBD0(int a1, int a2, int a3, char a4)
{
  *(_BYTE *)a3 = *(_BYTE *)a1;
}

*(BYTE*)(a1 + 0) is a pointer to a BYTE*

from the pointer of a1, how can I get the BYTES data that this that pointer points to? or is it impossible?, Because a1 points to a BYTE* in memory, I can ReadProcessMemory to get the data, but can I do it another way?

I’ve tried doing:

BYTE *data = *(BYTE*)&a1;

but it’s not working,

Am I missing something here?

Answer 1

Mmmm, this code looks pretty dirty. Is it a disassembly or something?

Anyway, the value a1 seems to be a pointer that is used as an int. You have this:

*(_BYTE *)a3 = *(_BYTE *)a1;

That is taking the first _BYTE value from the memory location that a1 points to and storing it in the memory location that a3 points to.

If you want to get the pointer itself, then just don’t dereference it:

BYTE *data = (BYTE*)a1;

All you are doing here is type-casting from an integer to a BYTE* (which I assume is the same as _BYTE).

Now you can reference BYTE values from data as if it was an array (assuming that the memory is actually allocated to your process):

BYTE secondVal = data[1];

And so on…