flat assembler
Message board for the users of flat assembler.

Index > Windows > Map memory from one process into another?

Goto page 1, 2  Next

Is this easier on other OSs?
Yes
20%
 20%  [ 1 ]
Very yes
0%
 0%  [ 0 ]
Very very yes
20%
 20%  [ 1 ]
No
60%
 60%  [ 3 ]
Total Votes : 5

Author
Thread Post new topic Reply to topic
Azu



Joined: 16 Dec 2008
Posts: 1159
Azu 20 Aug 2009, 09:04
Hi
I want to do something like this


Code:
HowManyBytesToMap equ 4;Just for the example. For my real usage I want to map a few hundred megabytes.
invoke functionGoesHere,RemoteProcessID,StartingAddressInRemoteProcess,UnusedAddressSpaceInCurrentAddress,HowManyBytesToMap
add dword[UnusedAddressSpaceInCurrentAddress],123    


And have it be the same as the below, but without having to make a function call for each read and write
Code:
HowManyBytes equ 4;
invoke ReadProcessMemory,RemoteProcessID,StartingAddressInRemoteProcess,HowManyBytes,tmp
add dword[tmp],123
invoke WriteProcessMemory,RemoteProcessID,StartingAddressInRemoteProcess,HowManyBytes,tmp
tmp rb HowManyBytes    




Is there a function that will do this? I thought this was what I was looking for but it needs code ran in the remote process.. which defeats the purpose (if I had no problem running my code in that process, why would I waste resources by having my own process at all?).
Post 20 Aug 2009, 09:04
View user's profile Send private message Send e-mail AIM Address Yahoo Messenger MSN Messenger ICQ Number Reply with quote
revolution
When all else fails, read the source


Joined: 24 Aug 2004
Posts: 20363
Location: In your JS exploiting you and your system
revolution 20 Aug 2009, 09:16
You can use the debug functions to control the other process and it's memory space

You can use MapViewOfFile in each process to view and alter the same values.
Post 20 Aug 2009, 09:16
View user's profile Send private message Visit poster's website Reply with quote
Azu



Joined: 16 Dec 2008
Posts: 1159
Azu 20 Aug 2009, 09:20
Thanks.. how do I use MapViewOfFile without injecting code into the remote process and running it?
Post 20 Aug 2009, 09:20
View user's profile Send private message Send e-mail AIM Address Yahoo Messenger MSN Messenger ICQ Number Reply with quote
revolution
When all else fails, read the source


Joined: 24 Aug 2004
Posts: 20363
Location: In your JS exploiting you and your system
revolution 20 Aug 2009, 09:25
Azu wrote:
how do I use MapViewOfFile without injecting code into the remote process and running it?
You put a little function in the source and recompile. No need to inject code, have the code there ready and waiting each time it starts up.
Post 20 Aug 2009, 09:25
View user's profile Send private message Visit poster's website Reply with quote
Azu



Joined: 16 Dec 2008
Posts: 1159
Azu 20 Aug 2009, 09:27
Azu wrote:
Is there a function that will do this? I thought this was what I was looking for but it needs code ran in the remote process.. which defeats the purpose (if I had no problem running my code in that process, why would I waste resources by having my own process at all?).
Sad
Post 20 Aug 2009, 09:27
View user's profile Send private message Send e-mail AIM Address Yahoo Messenger MSN Messenger ICQ Number Reply with quote
revolution
When all else fails, read the source


Joined: 24 Aug 2004
Posts: 20363
Location: In your JS exploiting you and your system
revolution 20 Aug 2009, 09:31
So debug then.
Post 20 Aug 2009, 09:31
View user's profile Send private message Visit poster's website Reply with quote
Azu



Joined: 16 Dec 2008
Posts: 1159
Azu 20 Aug 2009, 09:44
I can't find any DLLs that export that function.. is it a syscall?
Post 20 Aug 2009, 09:44
View user's profile Send private message Send e-mail AIM Address Yahoo Messenger MSN Messenger ICQ Number Reply with quote
revolution
When all else fails, read the source


Joined: 24 Aug 2004
Posts: 20363
Location: In your JS exploiting you and your system
revolution 20 Aug 2009, 09:45
Win32 manual (TFM) wrote:
The following functions are used with debugging.

ContinueDebugEvent
DebugActiveProcess
DebugBreak
FatalExit
FlushInstructionCache
GetThreadContext
GetThreadSelectorEntry
IsDebuggerPresent
OutputDebugString
ReadProcessMemory
SetDebugErrorLevel
SetThreadContext
WaitForDebugEvent
WriteProcessMemory
Post 20 Aug 2009, 09:45
View user's profile Send private message Visit poster's website Reply with quote
Azu



Joined: 16 Dec 2008
Posts: 1159
Azu 20 Aug 2009, 09:58
I read the MSDN descriptions of them all.. but none of them do what I described.. Confused
Post 20 Aug 2009, 09:58
View user's profile Send private message Send e-mail AIM Address Yahoo Messenger MSN Messenger ICQ Number Reply with quote
revolution
When all else fails, read the source


Joined: 24 Aug 2004
Posts: 20363
Location: In your JS exploiting you and your system
revolution 20 Aug 2009, 10:02
You have to look for other ways. AFAIK Windows only uses MapViewOfFile to map user memory to more than one process.
Post 20 Aug 2009, 10:02
View user's profile Send private message Visit poster's website Reply with quote
Azu



Joined: 16 Dec 2008
Posts: 1159
Azu 20 Aug 2009, 10:05
So it's impossible in user-mode unless my code is already running in that process? Sad
Post 20 Aug 2009, 10:05
View user's profile Send private message Send e-mail AIM Address Yahoo Messenger MSN Messenger ICQ Number Reply with quote
revolution
When all else fails, read the source


Joined: 24 Aug 2004
Posts: 20363
Location: In your JS exploiting you and your system
revolution 20 Aug 2009, 10:08
Azu wrote:
So it's impossible in user-mode unless my code is already running in that process? Sad
I don't know about impossible. You could probably write a kernel mode driver or something. But certainly not easy, or made transparent by the MS public documents.
Post 20 Aug 2009, 10:08
View user's profile Send private message Visit poster's website Reply with quote
Azu



Joined: 16 Dec 2008
Posts: 1159
Azu 20 Aug 2009, 10:23
Azu wrote:
in user-mode
Sad



Ah well, thanks anyways. Saved me a lot of time hunting through the API looking for stuff.
Post 20 Aug 2009, 10:23
View user's profile Send private message Send e-mail AIM Address Yahoo Messenger MSN Messenger ICQ Number Reply with quote
revolution
When all else fails, read the source


Joined: 24 Aug 2004
Posts: 20363
Location: In your JS exploiting you and your system
revolution 20 Aug 2009, 10:38
Actually there is no need to go through the API for things like this, just browse the articles in the Win32 help manual (it is also online at MSDN but might be harder to find there). There is an article that specifically deals with shared memory and it is (strangely Razz) called shared memory.
Post 20 Aug 2009, 10:38
View user's profile Send private message Visit poster's website Reply with quote
Azu



Joined: 16 Dec 2008
Posts: 1159
Azu 20 Aug 2009, 11:23
Azu wrote:
Azu wrote:
Is there a function that will do this? I thought [url=http://msdn.microsoft.com/en-us/library/aa366551(VS.85).aspx]this[/url] was what I was looking for but it needs code ran in the remote process.. which defeats the purpose (if I had no problem running my code in that process, why would I waste resources by having my own process at all?).
Sad
You mean that one I linked to in the first message and said won't out for me? Confused
Post 20 Aug 2009, 11:23
View user's profile Send private message Send e-mail AIM Address Yahoo Messenger MSN Messenger ICQ Number Reply with quote
revolution
When all else fails, read the source


Joined: 24 Aug 2004
Posts: 20363
Location: In your JS exploiting you and your system
revolution 20 Aug 2009, 11:45
I never bothered to visit the unlinked URL. I take your word for it that it is what you say.
Post 20 Aug 2009, 11:45
View user's profile Send private message Visit poster's website Reply with quote
Azu



Joined: 16 Dec 2008
Posts: 1159
Azu 20 Aug 2009, 11:49
By unlinked you mean the one I put in [url][/url] link tags in the first post and quoted twice?

Anyways it was a question, not a statement.
Post 20 Aug 2009, 11:49
View user's profile Send private message Send e-mail AIM Address Yahoo Messenger MSN Messenger ICQ Number Reply with quote
revolution
When all else fails, read the source


Joined: 24 Aug 2004
Posts: 20363
Location: In your JS exploiting you and your system
revolution 20 Aug 2009, 11:52
Azu wrote:
By unlinked you mean the one I put in [url][/url] link tags in the first post and quoted twice?
Yes
Post 20 Aug 2009, 11:52
View user's profile Send private message Visit poster's website Reply with quote
Azu



Joined: 16 Dec 2008
Posts: 1159
Azu 20 Aug 2009, 12:01
Okay.. and your answer?
Post 20 Aug 2009, 12:01
View user's profile Send private message Send e-mail AIM Address Yahoo Messenger MSN Messenger ICQ Number Reply with quote
revolution
When all else fails, read the source


Joined: 24 Aug 2004
Posts: 20363
Location: In your JS exploiting you and your system
revolution 20 Aug 2009, 12:27
That MSDN article looks to be a new version of the older page that I have. Nicer and slightly more comprehensive. And yes, I doubt there is any other function that could do exactly what you want. The MSDN article is not hiding anything.
Post 20 Aug 2009, 12:27
View user's profile Send private message Visit poster's website Reply with quote
Display posts from previous:
Post new topic Reply to topic

Jump to:  
Goto page 1, 2  Next

< Last Thread | Next Thread >
Forum Rules:
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Copyright © 1999-2024, Tomasz Grysztar. Also on GitHub, YouTube.

Website powered by rwasa.