ReadProcessMemory with __int64 address

Question

Hey guys I want to get some memory from a process that I already know with CheatEngine. I defined a region that I want to scan (0x190D186FF->0x190D1870A) but the address is too big to be stored in a simple int. That's why I use an __int64 but with that modification ReadProcessMemory doesn't seems to handle the address anymore.

When I compile I got 3 warnings for VirtualProtectEx and ReadProcessMemory: cast to pointer from integer of different size

How can I read really big address from the memory ?

int main( int argc, char *argv[] ) {
HWND            hWnd;
DWORD           PID;
HANDLE          hProc;
__int64         address;
char            mem = 0;
PDWORD          oldProtect = 0;
int             valid = 0;
char            inputPID[4];

printf( "What is the program PID ?\n" );
fgets( inputPID, sizeof( inputPID ), stdin );
PID = (DWORD)atoi( inputPID );

hProc = OpenProcess( PROCESS_VM_READ, false, PID );

if ( !hProc ) {
    printf( "Error: Couldn't open process '%i'\n", PID );
    return 0;
}

for ( address = 0x190D186FF; address <= 0x190D1870A; address++ ) {

    VirtualProtectEx( hProc, (PVOID)address, (SIZE_T)sizeof( address ), PAGE_READONLY, oldProtect );

    valid = ReadProcessMemory( hProc, (PCVOID)address, &mem, (DWORD)sizeof( char ), NULL );

    if ( valid ) {
        printf( "Memory value at 0x%I64x: '%c'\n", address, mem );
    }

    VirtualProtectEx( hProc, (PVOID)address, (SIZE_T)sizeof( address ), (DWORD)oldProtect, NULL );
}

system( "pause" );

}

I'm on a 64 bit OS so i guess that compile a 64b process by default. (+ i tryed with -m64 and I get "unimplemented: 64bit mode not compiled in blablabla) — Zenny H., Oct 05 '16 at 13:42
"*I'm on a 64 bit OS so i guess that compile a 64b process by default*" - That is not a guarantee. To ensure that you get a 64bit executable, you likely have to explicitly configure your compiler for 64bit output, assuming it even has such an option. Depending on your compiler setup, it may be able to produce a 32bit executable when running on a 64bit OS, and a 64bit executable when running on a 32bit OS. — Remy Lebeau, Jul 09 '20 at 20:56

GuidedHacking · Answer 1 · 2019-10-12T02:43:57.747

Your problem is your trying to stuff 64bit of data into 32bit variables. You need to switch your project to build in x64.

Your compiler doesn't automatically compile as x64 on a 64 bit OS. You need to change your Configuration build type to compile for x64.

There are 2 ways you can go about making this easier on yourself.

1) Compile for same process architecture as the process you're going to be interacting with, this alleviates many problems. Use uintptr_t or UINT_PTR which will resolve to the correct pointer size either 32 bit or 64 bit depending which you compile for, for all your addresses and offsets.

2) Make your own TYPEDEF like

#define TARGET_X64

#ifdef TARGET_X64
typedef unsigned __int64 addr_ptr
#else
typedef unsigned int addr_ptr
#endif

Then define TARGET_X64 when you're interacting with a x64 process. If you do it like this, and you're compiling as x32 there are certain API's that with have complications when accessing x64 processes and vice versa.

I highly recommend using the first method.

ReadProcessMemory with __int64 address

1 Answers1

Linked