flat assembler
Message board for the users of flat assembler.

Index > Windows > Map memory from one process into another?

Goto page Previous  1, 2

Is this easier on other OSs?
Yes
20%
 20%  [ 1 ]
Very yes
0%
 0%  [ 0 ]
Very very yes
20%
 20%  [ 1 ]
No
60%
 60%  [ 3 ]
Total Votes : 5

Author
Thread Post new topic Reply to topic
r22



Joined: 27 Dec 2004
Posts: 805
r22
OpenProcess ->
VirtualAllocEx ->
[Read/Write]ProcessMemory
Is the Windows OS solution as mentioned by your first post.

Direct memory access to another process without running code (MapViewOfFile) in the other process seems like a logical fallacy to me. The processes run in different address space so you'd need
MOV [Far Pointer To Other Process Memory], data

If you found a solution it would be some virus-like hack that exploits a flaw in the Windows API.
Maybe something like:
OpenProcess ->
VirtualAllocEx ->
MapViewOfFile using the remote process handle and allocated memory address

I'm curious how you would accomplish this on another OS like Linux.
Post 20 Aug 2009, 13:41
View user's profile Send private message AIM Address Yahoo Messenger Reply with quote
Azu



Joined: 16 Dec 2008
Posts: 1160
Azu
Hmm.. I can't even get that damn "CreateFileMapping" even if I do run my code in the remote process.. the memory from it is always blank? Wtf? Is it reserving blank memory instead of accessing the memory that's already there!? Sad




r22 wrote:
OpenProcess ->
VirtualAllocEx ->
[Read/Write]ProcessMemory
Is the Windows OS solution as mentioned by your first post.

Direct memory access to another process without running code (MapViewOfFile) in the other process seems like a logical fallacy to me. The processes run in different address space so you'd need
MOV [Far Pointer To Other Process Memory], data

If you found a solution it would be some virus-like hack that exploits a flaw in the Windows API.
Maybe something like:
OpenProcess ->
VirtualAllocEx ->
MapViewOfFile using the remote process handle and allocated memory address

I'm curious how you would accomplish this on another OS like Linux.
How do I use VirtualAllocEx on committed memory without trashing it? Confused Also, for the lpAddress attribute, it says "The pointer that specifies a desired starting address for the region of pages that you want to allocate.".. by "desired" does it mean it might not start there? Like even if I explicitly put $400000 it won't consistently give me access starting from the base address? It could go to $1234567 for all I know? What am I supposed to do with that? Confused
Post 21 Aug 2009, 01:43
View user's profile Send private message Send e-mail AIM Address Yahoo Messenger MSN Messenger ICQ Number Reply with quote
Feryno



Joined: 23 Mar 2005
Posts: 454
Location: Czech republic, Slovak republic
Feryno
- at first obtain memory map using VirtualQueryEx
- then you can read/write mapped memory using ReadProcessMemory / WriteProcessMemory

for both you need a handle to the process (use OpenProcess to obtain it) and access privileges high enough
Post 21 Aug 2009, 07:35
View user's profile Send private message Visit poster's website ICQ Number Reply with quote
Azu



Joined: 16 Dec 2008
Posts: 1160
Azu
Thanks.. so the way to read and write from a remote process without using ReadProcessMemory and WriteProcessMemory each time is to use ReadProcessMemory and WriteProcessMemory each time.. fantastic! That is the most insightful answer I have ever gotten, to anything, ever. Really. What can I do to ever repay you for your magnificent breakthrough in logic? I think I will be forever indebted to you. I love this forum so VERY much more now! Very Happy
Please can I have your autograph? You're sure to win several Nobel Peace Prizes with your abilities so I think it will be worth quite a lot of money some day.
[/VERY heavy sarcasm]
Post 21 Aug 2009, 07:37
View user's profile Send private message Send e-mail AIM Address Yahoo Messenger MSN Messenger ICQ Number Reply with quote
Defsanguje



Joined: 07 Aug 2006
Posts: 7
Location: Finland
Defsanguje
How about ZwMapViewOfSection? It's available for usermode but I've never used it though... And the name sounds promising. Take look at it Wink


Last edited by Defsanguje on 21 Aug 2009, 10:19; edited 1 time in total
Post 21 Aug 2009, 09:34
View user's profile Send private message MSN Messenger Reply with quote
revolution
When all else fails, read the source


Joined: 24 Aug 2004
Posts: 17279
Location: In your JS exploiting you and your system
revolution
Azu wrote:
Thanks.. so the way to read and write from a remote process without using ReadProcessMemory and WriteProcessMemory each time is to use ReadProcessMemory and WriteProcessMemory each time.. fantastic! That is the most insightful answer I have ever gotten, to anything, ever. Really. What can I do to ever repay you for your magnificent breakthrough in logic? I think I will be forever indebted to you. I love this forum so VERY much more now! Very Happy
Please can I have your autograph? You're sure to win several Nobel Peace Prizes with your abilities so I think it will be worth quite a lot of money some day.
That was uncalled for Azu. Try to be more forgiving. People here are trying to help you, don't attack them.
Post 21 Aug 2009, 09:50
View user's profile Send private message Visit poster's website Reply with quote
Azu



Joined: 16 Dec 2008
Posts: 1160
Azu
revolution wrote:
That was uncalled for Azu. Try to be more forgiving. People here are trying to help you, don't attack them.
I asked "how to access memory from another process without ReadProcessMemory/ReadProcessMemory", he answered "with ReadProcessMemory/ReadProcessMemory", and you're trying to guilt trip me for not being grateful to him? He was obviously joking, so I joked back. Razz


Defsanguje wrote:
How about ZwMapViewOfSection? It's available for usermode but I've never used it though... And the name sounds promising. Take look at it Wink
Now that's what I was looking for. Thank you. (technically I need NtMapViewOfSection, the user-mode version, but that's just semantics)
Post 21 Aug 2009, 10:30
View user's profile Send private message Send e-mail AIM Address Yahoo Messenger MSN Messenger ICQ Number Reply with quote
blacky



Joined: 06 Apr 2006
Posts: 32
Location: JA
blacky
Use Remot Threads


Last edited by blacky on 05 Oct 2009, 22:48; edited 2 times in total
Post 05 Oct 2009, 22:19
View user's profile Send private message MSN Messenger Reply with quote
Azu



Joined: 16 Dec 2008
Posts: 1160
Azu
I do. But there are more than one and they need to communicate efficiently.

_________________
Post 05 Oct 2009, 22:24
View user's profile Send private message Send e-mail AIM Address Yahoo Messenger MSN Messenger ICQ Number Reply with quote
blacky



Joined: 06 Apr 2006
Posts: 32
Location: JA
blacky
Remote Threads utilizing a Shared MEmory is what comes to mind for me.

HEres what my head is thnking.

Create a unique method in the Mapped Section that all the threads can communicate from, the shared memories purpose to successully maintain this communication, working as a middle man in some sense, (You could also try Piping) The concet sounds simple but it actually is quite task to have multiple Threads work in such a remote way, but it souns like something fun to try i guess
Post 05 Oct 2009, 22:46
View user's profile Send private message MSN Messenger Reply with quote
Azu



Joined: 16 Dec 2008
Posts: 1160
Azu
What I mean is, I need to map the memory of the processes, so I can access it directly. Running a thread in each of them and trying to get the threads to talk to eachother is slow/inefficient/buggy(race conditions)..
Post 06 Oct 2009, 00:07
View user's profile Send private message Send e-mail AIM Address Yahoo Messenger MSN Messenger ICQ Number Reply with quote
blacky



Joined: 06 Apr 2006
Posts: 32
Location: JA
blacky
ok this is it
Code:
Process1           |              |Process2       
|                  |              |               
|________          |              |____________   
|Mapped MEM Region |-- -------->   |Mapped from p!|
|________          |move to P2    |              |
|                  |              |              |
|                  |              |              |
    


So you want to map some(all?) memory from one process into another?
Sounds like a fun project, Have you tried using the Mapping API's
MapView the region of memory, Allocating it first then Mapping it, after this i would dump the view as raw data then loading it into the other process using the same functions, Allocating and Mapping the data to read it from P2. If this still isnt anything close to what youre trying to do then ill probably go for this since it does sseem like a fun way to edit memory "remotely". Cause after you have the actual data you can edit it, then inject it back into the remote process, although there are a bunch of drawbacks to it, still..some good POC could come out of t Very Happy
EDT: If your emphasis is on DIRECTLY wrting to these processes then my idea is just an idea and no help to you at all.. :<
Post 06 Oct 2009, 01:48
View user's profile Send private message MSN Messenger Reply with quote
Azu



Joined: 16 Dec 2008
Posts: 1160
Azu
Ack, sorry. I wasn't ignoring you. This board keeps unsubscribing me from threads for no reason >_>;


I meant directly. Like have the address range C through D in process 2 point to the same memory as address range A through B in process 1. And I want to do this to a whole bunch of processes.
Post 30 Oct 2009, 19:03
View user's profile Send private message Send e-mail AIM Address Yahoo Messenger MSN Messenger ICQ Number Reply with quote
Display posts from previous:
Post new topic Reply to topic

Jump to:  
Goto page Previous  1, 2

< Last Thread | Next Thread >
Forum Rules:
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Copyright © 1999-2020, Tomasz Grysztar. Also on YouTube, Twitter.

Website powered by rwasa.