I am trying to figure out how to read an integer value by reading a pointer to that integer. I am trying to do this from the user application level by using Windows ReadProcessMemory. I previously was trying to read values from memory through a VM but after assuming that is impossible I switched up my approach. If you want more context on how I got these pointer values check out this post I made Reading an integer from memory located on a VM but in summary I used Cheat Engine to gain access to a pointer which always would point to a specific value despite how many times you close your application. I felt like that previous post was too long and obscure which was why it was overlooked hence why I decided to condense it down in hope I can resolve my core issue.
Firstly, I would like to point out that this may be a large pointer chain meaning the value I read from ReadAccessMemory may point to a pointer which points to another pointer and so on till it finally points to the actual integer value I want to read. The trouble I am having is reading the actual integer value when all I get from ReadAccessMemory is another pointer. I know the pointer does in fact at some point, point to the integer I want to read (I proved that in the link above). Normally to print the value of a pointer you include a * in front of the pointer variable inside your printf statement. This is explained in the short snippet of code...
int ammo = 13;
int *pAmmo;
pAmmo = &ammo;
printf("Value: %i PointerValue: %i Pointer: %p \n", pAmmo, *pAmmo, pAmmo);
Here is what the above code printed...
Value: 6422296 PointerValue: 13 Pointer: 0061FF1
All of that being said when I run the following code my application suddenly crashes and closes right after printing this printf("IntNormalRead: %i Pointer: %p \n", intRead, intRead); which means the next print statement which includes *intRead is the cause of the crash. When I comment that line out it runs correctly and stays open which means I found the cause of the crash but that does not help me to determine why it is crashing. I also have the same issue when trying to write to that value but I am hoping a solution to this would also solve my WriteProcessMemory issue. If anyone knows how I can actually get my code to print the target integers value I would be extremely grateful!
DWORD pid;
printf("Enter the process id: ");
scanf("%d", &pid);
printf("\n");
HANDLE hProcess = OpenProcess(PROCESS_VM_READ, FALSE, pid); //PROCESS_ALL_ACCESS gives all access, PROCESS_VM_READ gives reading access
if(hProcess == NULL) {
printf("OpenProcess Failed GetLastError: %d \n", GetLastError());
getchar();
return pressToClose(EXIT_FAILURE);
}
uintptr_t memoryAddress = 0x0061FF1C;
int *intRead = 0;
printf("Enter the integers memory address: ");
scanf("%x", &memoryAddress); //Use %x to denote hexidecimal (remember to add 0x to the start if a memory address)
printf("\n");
BOOL rpmReturn = ReadProcessMemory(hProcess, (LPCVOID) memoryAddress, &intRead, sizeof(int), NULL);
if (rpmReturn == FALSE) {
printf("ReadProcessMemory failed. GetLastError = %d \n", GetLastError());
getchar(); //This is required to stop the terminal from auto closing
return pressToClose(EXIT_FAILURE);
}
printf("IntNormalRead: %i Pointer: %p \n", intRead, intRead);
printf("PointerValue: %i \n", *intRead);
printf("Last Error %d \n", GetLastError()); //This does nothing since it crashes before getting here when I dont have the *intRead statement commented out
CloseHandle(hProcess); //This closes the handle object which is doccumented in link 3
getchar();
return pressToClose(EXIT_SUCCESS);
Tests
This pointer value 0x590844 points to a pointer chain that ends up pointing to this address 00710008 which contains the integer value I want to read (in this case my ammo count). Running my program above with the *intRead pintf statement commented out produces the following results...
Enter the process id: 2940
Enter the integers memory address: 00710008
IntNormalRead: 19 Pointer: 00000013
Last Error 126
Press any key to close...
When I dont comment that printf statement out my program instantly crashes without printing out any error messages. However, running my program again with the pintf statement commented out says the last Error had an error code of 126 "The specified module could not be found" was this the error caused by the printf statement in the previous failed execution? Anyways when I run my program again with the pointer value I want to use without the *intRead printf statement I get the following output.
Enter the process id: 2940
Enter the integers memory address: 0x590844
IntNormalRead: 162398256 Pointer: 09AE0030
Last Error 126
Press any key to close...
All of this checks out since it seems to be printing the address of another pointer however this does not help me solve this problem at all because I need to be able to print the actual value of the pointer which is normally done by using *intRead but that always crashes for some reason.