为什么将ReadProcessMemory（）与当前进程的句柄一起使用？

Question

Using NtQueryInformationProcess , one can obtain the current process base address by reading the PebBaseAddress field in the returned struct of type PROCESS_BASIC_INFORMATION.

I've seen code that uses ReadProcessMemory() to read memory with respect to the base address of the current process, as the first few bytes contain some pointers that reveal detailed process information. I also needed to obtain some of this information, and research showed me how to do so.

I'm still confused, however, as to why ReadProcessMemory() is required when reading memory from the current process. Can't the pointer relative to process base just be dereferenced, or will/may it result in a segmentation fault? Are pointers held with respect to the process base?

Answer 1

ReadProcessMemory will check for you that the address range in your own process is valid and return error (ERROR_PARTIAL_COPY) in the case of problem instead of crashing.

Other than that I see no reason. If you are sure that your pointer is correct, it is fine (and way faster) to use memcpy .