Read memory from application which does not allow it

Question

I am currently trying to read the entirety of the memory of a game which blocks calls to OpenProcess and ReadProcessMemory (I believe this is done through a windows driver/service, although I'm not sure how).

I use the following code to do try and open the process and read its memory to a file:

HANDLE process = OpenProcess(PROCESS_VM_READ, 0, pid);
if (!process) {
    cout << "Failed to open process.";
    return 1;
}
cout << "Successfully opened processs." << endl << "Dumping memory to mem.dmp..." << endl;

ofstream fout;
fout.open("mem.dmp");

char *base = (char *)0;
char *readCount = (char *)0;
do {
    char buffer[PAGE_SIZE];

    if (ReadProcessMemory(process, base, buffer, PAGE_SIZE, NULL) != 0)
    {
        fout << buffer;
    }

    base += PAGE_SIZE;
    readCount++;
} while (base != 0);
if (readCount == 0) {
    cout << "Warning: No memory was read from the process." << endl;
}
fout.flush();
fout.close();

However, when run, this cannot even open the process.

The only way to get past the driver blocking the process from being opened for memory reading is to dump the entirety of the physical memory to a file. I have no idea how to do this, other than having to set windows to dump all of the physical memory on a blue screen, and then forcing my computer to shutdown with a blue screen. This is obviously quite inconvenient as I will want to analyse the application's memory quite frequently.

Is there any way to dump all of the physical memory without using this method on Windows? I know virtually nothing about the driver or how it works so it would be almost impossible to work out another way of bypassing it.

Answer 1

You are trying to access the "0th" memory position, that is not possible (SO does not allow you to do it):

char *base = (char *) 0;

You should set correcly the address where you wanna read, and that address must be a readable address. Check the ReadProcessMemory doc here

lpBaseAddress [in] : A pointer to the base address in the specified process from which to read. Before any data transfer occurs, the system verifies that all data in the base address and memory of the specified size is accessible for read access, and if it is not accessible the function fails.

Check also the examples in this post here