Access to 32bit memory address c#

Question

I'm trying to access a 32bit address, but when i create the IntPtr it throws an OverflowException. Here's the code:

uint memAddr = 0xF5920824;
IntPtr bufPtr = new IntPtr(memAddr);
byte[] data = new byte[4];
Marshal.Copy(bufPtr, data, 0, 4);

How can i access that address?

The address you're trying to read is at the 3GB point - depending on your OS I believe that's a restricted address — Dave, Jun 27 '12 at 15:09
i simply want to improve my knowledge and i'm using a program (done by a friend) that has a hidden value (which i know) at that address. My OS is Win7 64 bit and i'm using visual studio 32bit (student version), what information do you need? — giuse, Jun 27 '12 at 15:11
@Demon0112 - You are trying to access an illegal address. Compile your application as a x64 application and it no longer will be illegal. — Security Hound, Jun 27 '12 at 15:12
Perhaps you need to get a pointer from that program. (Or use Cheat Engine) — Kendall Frey, Jun 27 '12 at 15:13
You have memAddr declared as an uint. The constructor to IntPtr takes an int. The value you provided for memAddr causes the overflow. — David W, Jun 27 '12 at 15:14

score 3 · Answer 1 · answered Jun 27 '12 at 15:11

3

For such a large number > 2^31-1 you need to compile as 64 bit.

Go to Configuration Manager... and change platform from x86 to Any CPU or x64.

answered Jun 27 '12 at 15:11

weston

54,145
21
145
203

score 2 · Answer 2 · answered Jun 27 '12 at 15:12

2

By passing a uint to IntPtr, you are converting it to a long, as IntPtr doesn't support unsigned integers. Then, if you are running in a 32-bit process, your uint overflows an int.

You need to use 64-bit to read that address.

answered Jun 27 '12 at 15:12

Kendall Frey

43,130
20
110
148

score 2 · Accepted Answer · edited May 23 '17 at 11:56

Your program CANNOT access a memory address of another program (regardless that the address you're going to read can't fit an Int32, see this post to understand what it is) simply using an IntPtrbecause they run within their private address space.

It must be shared somehow by the first program (shared memory or something else). Moreover an address XYZ in one program may be something completely different even in another instance of the same program (because the address is VIRTUAL).

If you're sure about the memory address (how? it could be even necessary to scan process memory) you have to P/Invoke ReadProcessMemory(), it's a function designed for debugging purposes and if your executable has enough privileges you can read the memory of another process.
See this post here on SO for an example.

Access to 32bit memory address c#

3 Answers3