Question

So I’m reading the memory of another program for the purpose of reverse engineering. I’m using a function from kernel32.dll.

The function looks like this:

ReadProcessMemory(Handle, new IntPtr(Address), buffer, BytesToRead, out ptrBytesRead);

I’m using it to read memory bit by bit, like so:

    public static int ReadInt32(IntPtr Handle, long Address)
    {
        return BitConverter.ToInt32(ReadBytes(Handle, Address, 4), 0);
    }

Then calling ReadInt32 using a programs handle and the address I’m looking to read, adding the base address of the program as it is not static.

What I’d like to do is read a whole chunk of memory (up to 1300 records, each record has a memory step of 0xB0).

I’m not sure exactly what the best way is to go about this. I’ve looked into it and it looks like it is possible to do something where I take the whole thing and basically dump it into a structure of my own. The problem I’m having is that I don’t quite know what I need to actually do. I can see it in my mind, but can’t put pen to paper on it.

I’ll expand to show that it is in fact a 2d array, looking like this in structure:

    int OFFSET_CREATURE_ID = 0;
    int OFFSET_CREATURE_TYPE = 3;
    int OFFSET_CREATURE_NAME = 4;
    int OFFSET_CREATURE_Z = 36;
    int OFFSET_CREATURE_Y = 40;
    int OFFSET_CREATURE_X = 44;
    int OFFSET_CREATURE_IS_WALKING = 80;
    int OFFSET_CREATURE_DIRECTION = 84;
    int OFFSET_CREATURE_OUTFIT = 100;
    int OFFSET_CREATURE_OUTFIT_HEAD = 104;
    int OFFSET_CREATURE_OUTFIT_BODY = 108;
    int OFFSET_CREATURE_OUTFIT_LEGS = 112;
    int OFFSET_CREATURE_OUTFIT_FEET = 116;
    int OFFSET_CREATURE_OUTFIT_ADDON = 120;
    int OFFSET_CREATURE_LIGHT = 124;
    int OFFSET_CREATURE_LIGHT_COLOR = 128;
    int OFFSET_CREATURE_HP_BAR = 140;
    int OFFSET_CREATURE_WALK_SPEED = 144;
    int OFFSET_CREATURE_IS_VISIBLE = 148;
    int OFFSET_CREATURE_SKULL = 152;
    int OFFSET_CREATURE_PARTY = 156;
    int OFFSET_CREATURE_WARICON = 164;
    int OFFSET_CREATURE_ISBLOCKING = 168;

Each of those offsets needs to be assigned to a different element in my structure. Some of them are bool, some int, and some string. I’ve got the struct. I can’t guarentee that the length will consume the entire “step” for each offset, though when I read these values I think I need to declare a new instance of the struct each time (I will be reading them each 500ms or so, maybe more! The total read time for 250 records is approx 50ms, which is what I expect to read! I do need to be able to do up to 1300 though).

Please, no confusing code, just an explanation of what I should do would suffice. I struggle a lot when I’m working with this amount of code, so unless someone is going to put together a class which will read all of this, with a structure to store it (so I can convert it to work with mine), I’d appreciate literally minimal code.

Answer 1

For the primitive types if you know the offset you can simply take the bits from offset n (beginning of data) to n+1 and use a BitConverter to convert to the type. Because you can’t specify an end with methods such as ToInt32(byte[] value, int startIndex) you’ll have to copy the bytes into a new array.

Lets just assume every thing is an int for this example. I’m also going to assume all of the offsets are in an array. Bytes is the memblock you got from ReadInt32

int[] values = new int[Bytes.Length/4];
byte[] current = new byte[4];
BitConverter bc = new BitConvert();
for (i = 0; i < Bytes.Length/4 -1; i++)
{
     Buffer(Bytes, i(4), current, 0, 4); 
     values[i] = bc.ToInt32(current, 0);   
}

This is a huge simplification but it should be enough to get you moving in the right direction. You may not even want to use a loop (maybe you just hard code all of the BitConverter instructions, that is how you do serialization when reading from a db in C/C++) If you have many types that will also make things simpler. Either way the basic concept will be to use a bit converter to convert sections of the bytes you read from the other program into their respective properties in your data structure.