How to find the starting address of an application for memory editing a process?

7.9k views Asked by At

I want to know how to find the valid addresses of an application from beginning to end because I want to know how to memory edit an application for example Notepad. Do I have to decompile the application and see the assembly code or machine code. Because I see people always making mods for applications like minesweeper and some PC video games.

P.S. I will be using the programming language C# and Win32 functions to perform the memory editing.

2

There are 2 answers

1
Loman On BEST ANSWER

To find the start and end addresses for a process

Process proc = Process.GetCurrentProcess();
IntPtr startOffset = proc.MainModule.BaseAddress; 
IntPtr endOffset = IntPtr.Add(startOffset ,proc.MainModule.ModuleMemorySize); 

http://www.ownedcore.com is a good resource to learn about memory editing.

0
KulaGGin On

First, you use GetSystemInfo Win32API function to get minimum and maximum virtual addresses available to applications. Then you scan chunks of memory starting from the minimum address and ending at the maximum address available. But you skip(you don't scan them) all the chunks which you can't read. Here's a post on CodeProject which shows that: https://www.codeproject.com/articles/716227/csharp-how-to-scan-a-process-memory