how can i read one memory byte

Question

Here is memory block I'm working with:

You can see 8b ff 55 8b ec 83 7d 0c 01 . . . . code. I want to get one each byte, so I tried:

DWORD offset; // this memroy has '0x61CAB0E4' and that means '8b ff 55... memroy block'
BYTE Result;
memcpy(&Result, &offset, 1); //1 mean byte as I want

BUT, the result is not correct. If I debug, the result value is 228 and I was expecting that value would be 8b.

How can I memory block one byte one?

8b,
ff,
55,
8b,
ec,
83,
7d,

....etc

These are the results:

`memcopy` does copy ` bye exactly, I'm not sure what your problem is? How are you trying to look at `Result`? — kabanus, Nov 09 '17 at 11:35

kabanus · Accepted Answer · 2017-11-09T12:00:17.247

1

You are not converting properly your result, and misinterpreting:

Your result is indeed decimal - 228.
In binary this is 11100100
The data is most likely stored in 2s complement in your P and depending on the endian and assuming the debugger just interpreted the binary as binary you get 10001011 - this is 139.
Finally, convert to two digit hex number: 1000 is 8, 1011 is 11 which is b, so finally 8b.

edited Nov 09 '17 at 12:00

answered Nov 09 '17 at 11:42

kabanus

24,623
6
41
74

after that offset += 1 (1byte move) – mwK Nov 09 '17 at 11:46
and memcpy same thing – mwK Nov 09 '17 at 11:46
but that result is 229. – mwK Nov 09 '17 at 11:47
but 229 is not same ff as i thought – mwK Nov 09 '17 at 11:47
If you did not move the offset yourself, it won't move - you're probably copying the same thing. – kabanus Nov 09 '17 at 11:48
but as all my code, i add offset move, by using offset += 1; – mwK Nov 09 '17 at 11:50
you can see picture "attach result picture" – mwK Nov 09 '17 at 11:50
Please print it (cout) and to the terminal to make sure what you're seeing. – kabanus Nov 09 '17 at 11:52
sorry.. i cant understand what you mean... so sorry; – mwK Nov 09 '17 at 11:55
I realized that I needed to use a pointer to transfer my address. – mwK Nov 09 '17 at 12:01
But with C ++ code, i dont know how to convert it into regular binary. for example 228 to 139 – mwK Nov 09 '17 at 12:02
i dont understand how to change 228 to 139. – mwK Nov 10 '17 at 01:35
if 11100100(228) is stored in little-endian as 2s complement – mwK Nov 10 '17 at 01:39
11100100 -> 00100111(little-endian) – mwK Nov 10 '17 at 01:40
you say 2s complement, so 00100111 -> 11011000 -> 11011001 – mwK Nov 10 '17 at 01:41

how can i read one memory byte

1 Answers1