如何从内存地址获取值？

Question

I want to get the value from a memory address which I have without crashing the program.

here is my code:

int main(){
    int *ptr=(int*)0x09D37570;
    while(1){
        system("cls");
        cout<<(*ptr);
    }
    return 0;
}

but that crashes the program, it crashes by calling *ptr, why does that happen? how can i get the value without problems?

Answer 1

You're taking a hardcoded address and expecting it to hold the value you saw. However, there are a couple problems with that:

If worrying about your own process, you have to own that memory. Something you allocate with new or the like had better have snatched that address, otherwise there's no telling what will happen. For example:

int *someAddress = new int (5);
int *somePtr = someAddress; //point to same address as newed
int someInt = *somePtr; //someInt is 5
++somePtr; //uh-oh, now we've left what we newed; it might not be allocated
someInt = *somePtr; //there's no telling if that memory was ok to use

If it does happen to work, you'll just get some random number. And indeed, if you loop it long enough, it will crash eventually. However, even being a problem, it doesn't even directly pertain here!

The biggest problem is that even though it has the same address, it's not the same memory. This might sound confusing, but it's a pretty great topic ( http://en.wikipedia.org/wiki/Virtual_address_space ). Basically, each process has the same address values, but they map to different areas in actual memory. Therefore, your hardcoded address pertains to your process only.

One way you can look through other processes' memory, on Windows at least, is to use ReadProcessMemory . On the page, you can see the requirements, such as having the PROCESS_VM_READ privilege for the process you're reading from. Be sure to check GetLastError if it fails, too. There's somewhat of a small example here .

Note that VirtualQueryEx is a good thing to look into before calling ReadProcessMemory , too.

It might work, or it might not, but it's the best thing I know of for poking around in other processes' memory space. It's worth a shot if you're set on accomplishing this.

Answer 2

Every process has its own memory space, the same address in different processes maps different physical address, so it is meaningless to do like that.

Answer 3

If you are on Linux, you can use gdb to attach to the process, and hit Ctrl-C at some point and then examine the memory. The command is x , so

x 0x09D37570

and you should be able to also do

print *(int*)0x09D37570;

Using gdb , you are in the protected memory space of the process.

What you are trying to do does work if there is no operating system. It is the correct way of getting to memory if you are developing firmware, without virtual memory address.

https://sourceware.org/gdb/current/onlinedocs/gdb/Memory.html