C + +指针+偏移量读取内存地址

Question

I am trying to read an address of a process which should be the number 20. I determined this address was located at the dll base offset + a number with an offset of 10. I am using

ReadProcessMemory(phandle, (void*)address, &number, sizeof(number), 0);

to read a specific address. My question is how do I correctly search for the address located at "57B86F68" + the 10 offset?

Answer 1

You can read the data from handle if your phandle is a process handle with PROCESS_VM_READ access granted:

ReadProcessMemory(phandle, (void*)(0x57B86F68 + 0x10), &number, sizeof(number), 0);

To get proper access rights for the process handle check your OpenProcess flags, PROCESS_VM_READ should be there.

If it still not working things are much more complex. You should translate your virtual address to physical address and after that get direct access to the memory via kernel mode .