Summary:
So basically I'm trying to read/write to the target process ConsoleApplication1.exe using ReadProcessMemory
and WriteProcessMemory
functions in the winapi. I am able to read from the target process memory but I'm not able to write to the memory.
Details:
GetBaseAddress
(Process that is used to read/write to the memory)
Code:
// GetBaseAddress.cpp : This file contains the 'main' function. Program execution begins and ends there.
//
#include <sstream>
#include <iostream>
#include <windows.h>
#include <psapi.h>
#include <processthreadsapi.h>
#include <tlhelp32.h>
#include <string.h>
using namespace std;
DWORD FindID(char *name );
void errExit(const char msg[50], HANDLE handle = 0);
int main()
{
std::cout << "Hello World!\n";
/*Find Process ID by Name*/
char name[] = "ConsoleApplication1.exe";
DWORD processID = FindID(name);
HANDLE processHandle = OpenProcess(PROCESS_ALL_ACCESS, false, processID);
HANDLE snapshot = CreateToolhelp32Snapshot(TH32CS_SNAPMODULE, processID);
if (snapshot == INVALID_HANDLE_VALUE || processHandle == NULL||processHandle == INVALID_HANDLE_VALUE) {
errExit("Counldn't create snapshot exiting...", snapshot);
}
cout << "[+]Snapshot created for PID:" << processID << endl;
cout << "[+]Retriving Module Info..." << endl;
MODULEENTRY32 moduleEntry ;
moduleEntry.dwSize = sizeof(MODULEENTRY32);
if (Module32First(snapshot, &moduleEntry) == FALSE) {
errExit("Counldn't retrive entry exiting...",processHandle);
}
//stringstream address;
//
char buff[12] = "Hello World";
DWORD offset = 0x19B44; //HelloWorld - [H]
//
//BYTE word = *moduleEntry.modBaseAddr;
DWORD_PTR dwModuleBaseAddress = (DWORD_PTR)moduleEntry.modBaseAddr+offset;
std::stringstream stream;
stream << std::hex << dwModuleBaseAddress;
std::string hexAddress = stream.str();
cout << "[+]Base Address of the module is:" << hexAddress << endl;
cout << "[+]Reading Memory..." << endl;
BOOL rslt = ReadProcessMemory(processHandle, moduleEntry.modBaseAddr + offset, buff, sizeof(buff) - 1, NULL);
if (rslt == FALSE) {
errExit("Couldn't read memory region exiting...");
}
//char buff2[] = "Hacked ";
cout << "[+]Memory Data:" << buff << endl;
cout << endl;
rslt= WriteProcessMemory(processHandle, moduleEntry.modBaseAddr + offset,buff,sizeof(buff)-1,NULL);
if (rslt == FALSE) {
errExit("Couldn't write to the Memory Address");
}
}
DWORD FindID(char *name) {
cout << name << endl;
DWORD procIDs[1024],needed=0;
std::wstring str = L"ConsoleApplication1.exe";
int rslt = EnumProcesses(procIDs, sizeof(procIDs), &needed);
if (rslt==0) {
errExit("Procees IDs list couldn't be retrived exiting...");
}
cout << "[+]Process IDs List Retrived..." << endl;
cout << "[+]Bytes Returned:" << needed << endl;
cout << "[+]sizeof(DWORD):" << sizeof(DWORD) << endl;
cout << "[+]Number of Process Retrived:" << needed / sizeof(DWORD) << endl;
for (int i = 0;i <= needed / sizeof(DWORD); i++) {
HANDLE processHandle = OpenProcess(PROCESS_ALL_ACCESS, false, procIDs[i]);
if (processHandle == NULL) {
//CloseHandle(processHandle);
continue;
}
wchar_t processFileName[MAX_PATH];
GetModuleBaseNameW(processHandle, NULL, processFileName, sizeof(processFileName));
if (std::wstring(processFileName) == str) {
cout << "[+]Found:" << procIDs[i] << endl;
cout << "[+]Process " <<":" << i << endl;
wcout << "[+]Process Name" << ":" << processFileName << endl;
return procIDs[i];
}
CloseHandle(processHandle);
}
}
void errExit(const char msg[50], HANDLE handle) {
cout << "[-]"<<msg << endl;
cout << "[-]Retriving Last Error:" << GetLastError() << endl;
CloseHandle(handle);
system("pause");
exit(1);
}
Here I'm using modEntry.modBaseAddr + offset
to read and write to the memory location of the target process.
modEntry.modBaseAddr
holds the base address of the first module of the process and modEntry.modBaseAddr + offset
is the location of the first character of the string "Hello World" located in the target process.
This is the error I'm getting with WriteProcessMemory
:
998 - ERROR_NOACCESS
Invalid access to memory location.
Things I've already tried:
1. Using VirtualProtect
function to change protect region returns FALSE
with Old Protect being:
-PAGE_NOACCESS
0x01
According to Microsoft:
PAGE_NOACCESS 0x01
Disables all access to the committed region of pages. An attempt to read from, write to, or execute the committed region results in an access violation. This flag is not supported by the CreateFileMapping function.
2. Trying Multiple times - returns the same error
3. Using a hard-coded address - returns the same error
I tried to set the address directly as (LPVOID)0x619b44
Here, modEntry.modBaseAddr + offset = 0x619b44
4. Trying to CloseHandle and reopen the process using OpenProcess using PROCESS_VM_WRITE constraint - returns the same error
Here is the code for ConsoleApplication.exe (The target process in which I'm trying to overwrite data):
#include<Windows.h>
//#include<unistd.h>
#include <iostream>
using namespace std;
int main()
{
HANDLE d = GetModuleHandle(NULL);
cout << "Module Handle:"<<d<<endl;
int gold = 0;
int* ptr = &gold;
char buff[] = "Hello World\n";
std::cout << buff;
system("title hackme");
std::cout << "Enter something:";
std::cin >> gold;
for (;;) {
std::cout << buff;
//gold++;
std::cout << "Address:";
std::cout << &gold<< std::endl;
std::cout << gold << std::endl;
Sleep(1000);
}
cout << "Congrats Pro!!!" << endl;
}
OUTPUT for GetBaseAddress
:
OUTPUT for ConsoleApplication1.exe
Software Details:
- Microsoft Visual Studio Community 2019
- Version
16.11.23
- Optimization: Disabled
- OS: Window 10