flat assembler
Message board for the users of flat assembler.

Index > Windows > HELP HELP HELP

Author
Thread Post new topic Reply to topic
labron



Joined: 28 Aug 2013
Posts: 8
labron
Help me, not work Sad((


Code:
format pe gui 4.0
entry start
include 'win32ax.inc'

struct  MEMORY_BASIC_INFORMATION
        BaseAddress          dd ?
        AllocationBase       dd ?
        AllocationProtect    dd ?
        RegionSize           dd ?
        State                dd ?
        Protect              dd ?
        Type                 dd ?
ends

mbi MEMORY_BASIC_INFORMATION

proc start
invoke _lcreat, SzFile, 0
mov [hfile], eax
invoke OpenProcess,PROCESS_ALL_ACCESS, FALSE,[PID]
mov [hProc],eax
mov [shagMemory],0
gogogo:
invoke VirtualQueryEx, [hProc], [shagMemory], mbi,sizeof.MEMORY_BASIC_INFORMATION
or eax,eax
jz stopeee
invoke ReadProcessMemory,[hProc],[mbi.BaseAddress],bufer,[mbi.RegionSize],BytesRead

;invoke wsprintf,temp,formats,mbi.RegionSize
;invoke wsprintf,temps,formats,BytesRead
;invoke MessageBox,NULL,temp,temps,NULL

invoke _lwrite, [hfile],bufer,BytesRead

mov eax,[mbi.RegionSize]
add [shagMemory],eax
jmp gogogo
stopeee:
invoke CloseHandle, [hfile]
invoke CloseHandle, [hProc]
invoke MessageBox,NULL,'ExitProcess','End',NULL
invoke ExitProcess,0

endp


;/////////////////////////////////////////////////////////////
PID   dd 2844
hProc dd ?
shagMemory dd ?
SzFile db 'G:\test.txt',0
hfile dd ?
BytesRead dd ?
formats db "%d",0
temp db 256 dup(?)
temps db 256 dup(?)
bufer dd ?
len_buf = $ - bufer



;/////////////////////////////////////////////////////////////

data import
library kernel32, 'KERNEL32.DLL',\
        user32,   'USER32.DLL'
import kernel32,\
GetLastError,'GetLastError',\
       ExitProcess, 'ExitProcess',\
       OpenProcess, 'OpenProcess',\
       GlobalAlloc, 'GlobalAlloc',\
       ReadProcessMemory, 'ReadProcessMemory',\
       CloseHandle, 'CloseHandle',\
       VirtualQueryEx, 'VirtualQueryEx',\
       _lcreat,'_lcreat',\
       _lwrite,'_lwrite',\
       Sleep,'Sleep'
import user32,\
       MessageBox, 'MessageBoxA',\
       wsprintf, 'wvsprintfA'
end data
    


dont reads block memory, BytesRead ≠ mbi.RegionSize and only 0 Sad((
Post 28 Aug 2013, 17:35
View user's profile Send private message AIM Address Reply with quote
AsmGuru62



Joined: 28 Jan 2004
Posts: 1412
Location: Toronto, Canada
AsmGuru62
What is PID = 2844?
What process are you trying to read?

P.S. Just noticed: "Post #1024" Epic!
Post 28 Aug 2013, 20:07
View user's profile Send private message Send e-mail Reply with quote
labron



Joined: 28 Aug 2013
Posts: 8
labron
PID correctly I put
Post 28 Aug 2013, 20:39
View user's profile Send private message AIM Address Reply with quote
labron



Joined: 28 Aug 2013
Posts: 8
labron
ReadProcessMemory returns 0
Post 28 Aug 2013, 20:39
View user's profile Send private message AIM Address Reply with quote
AsmGuru62



Joined: 28 Jan 2004
Posts: 1412
Location: Toronto, Canada
AsmGuru62
So, how did you know the PID?
Did you open Task Manager and saw it there?
Because, I think that the PID will be different next time the same process runs.

P.S. Why 'bufer' never allocated? It must be pointing somewhere.
Post 28 Aug 2013, 21:47
View user's profile Send private message Send e-mail Reply with quote
labron



Joined: 28 Aug 2013
Posts: 8
labron
OpenProcess - goodwork
VirtualQueryEx - goodwork
ReadProcessMemory - not work, return 0 Sad
Post 28 Aug 2013, 23:13
View user's profile Send private message AIM Address Reply with quote
AsmGuru62



Joined: 28 Jan 2004
Posts: 1412
Location: Toronto, Canada
AsmGuru62
I was working on your code, but now I am not home, so I just explain few things:

1. Buffer which is used to read process memory must be allocated at some size.
I used 1Mb, but it may not be enough, so some reallocation must be done.

2. PROCESS_ALL_ACCESS may not work on latest Windows versions.
It works on XP, but Win7, Win8, Vista may not be forgiving. It is
recommended to use a combination: PROCESS_QUERY_INFORMATION and PROCESS_VM_READ.

3. VirtualQueryEx returns the state of pages you examining.
Not all pages can be read with ReadProcessMemory, but only pages
in state MEM_COMMIT, so you have to check that flag before using
ReadProcessMemory.

4. When using ReadProcessMemory you begin with address NULL (you did that correctly).
But after you get the RegionSize -- just add that size to the address.
Do not use any of mbi.AllocationBase or mbi.BaseAddress -- it will give
ERROR_PARTIAL_READ errors.

Instead just use this pseudo-code:
Code:
Address = NULL;

while (VirtualQueryEx (... Address, ...) == sizeof.MEMORY_BASIC_INFORMATION)
{
        if (bmi.State has bit MEM_COMMIT)
        {
                if (RegionSize > allocated for buffer)
                {
                        ReAllocate buffer ...
                }
                ReadProcessMemory (... Address, ... RegionSize);
                _lwrite (...);
        }

        Address += RegionSize;
}
    


As a result of all this, you will have a file with sections from the process you are
reading, but there will be no indication at which address the data was in the process.
It will be just chunks of bytes appended together.
If you are trying to dump the process memory, then it is better to make a HEX
dump into a text file (it will be huge file) with the address of every dumped section.
Post 29 Aug 2013, 15:50
View user's profile Send private message Send e-mail Reply with quote
AsmGuru62



Joined: 28 Jan 2004
Posts: 1412
Location: Toronto, Canada
AsmGuru62
@labron:
Please read this thread from StackOverflow:
http://stackoverflow.com/questions/4457171/why-does-readprocessmemory-have-lpnumberofbytesread

Also take a look at the attached files.
The dumper works, but sometimes I get the ERROR_PARTIAL_COPY.


Description:
Download
Filename: SomeCode.Asm
Filesize: 3.7 KB
Downloaded: 53 Time(s)

Description:
Download
Filename: HELP1.Asm
Filesize: 2.34 KB
Downloaded: 43 Time(s)

Post 30 Aug 2013, 02:55
View user's profile Send private message Send e-mail Reply with quote
labron



Joined: 28 Aug 2013
Posts: 8
labron
ok, big thx Wink
Post 30 Aug 2013, 21:35
View user's profile Send private message AIM Address Reply with quote
labron



Joined: 28 Aug 2013
Posts: 8
labron
I made, all thanks a lot!!!
Post 30 Aug 2013, 22:43
View user's profile Send private message AIM Address Reply with quote
Display posts from previous:
Post new topic Reply to topic

Jump to:  


< Last Thread | Next Thread >
Forum Rules:
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Copyright © 1999-2020, Tomasz Grysztar. Also on YouTube, Twitter.

Website powered by rwasa.