Question

I’m building a monitor app and am having some threading issues.

I have, using a cbt hook, injected a dll in to another processes memory. I am reading the memory of the other application at certain addresses. The trouble is I was using a loop to watch the process and basically the app being watched wasn’t free to carry on. So I thought put my watch process in a thread. I am using the code below to create the thread:

void readAddresses(DWORD addr)
{
LPDWORD dwThreadID;
HANDLE hThread = CreateThread(NULL,0,ThreadProc,&addr,0,dwThreadID);
}

I did try with CreateRemoteThread(…) as well and got the same error. With the thread running when it calls the ReadProcessMemory() api it fails and i am not really sure what I am doing wrong.

//going to pass in an address, dword
DWORD WINAPI ThreadProc(LPVOID lpParameter)
{
 DWORD pid;
 GetWindowThreadProcessId(targetWindow,&pid);
 HANDLE hProcess = ::OpenProcess(PROCESS_CREATE_THREAD | PROCESS_QUERY_INFORMATION | 
                         PROCESS_VM_OPERATION | PROCESS_VM_WRITE | PROCESS_VM_READ,
                         FALSE, pid);

...
ReadProcessMemory(hProcess,(void *)_start, data, 255, &lpRead);
...

}

The trouble is when I call readprocessmemory I now get an access violation. What I am curious about is that is the thread operating in the same process address space as the process into which it been injected. As I said without the thread code it works fine but i need the monitor code to run in the background and i am wondering how to achieve this? Should I use create remote thread?

As Remus sais use beginthread() or beginthreadex()…

Thanks

Answer 1

One thing is sure: addresses to read and write are definitely not a DWORD type. From the code above, it seems that you pass an DWORD addr as the address to read from, then you start a thread to which you pass on the address of your local addr parameter. Most likely the thread proc is then attempting to read the address where the addr parameter once was in the current process on the original thread stack (a meaningless address now in any process) and the result is random (sometimes you will hit jackpot and read some innocent victim location on the remote process).

• pass in the address to read as a proper address (LPVOID). DWORD cannot be right.
• pass to the background thread the address you want to read, not some local stack frame garbage it cannot use

.

void readAddresses(LPVOID addr)
{
LPDWORD dwThreadID;
HANDLE hThread = CreateThread(NULL,0,myThreadProc,addr,0,dwThreadID);
}

DWORD WINAPI myThreadProc(LPVOID addr)
{
   ...
    ReadProcessMemory (..., addr);
}