possible to read specific types from memory?

254 views Asked by At

Using JNA I have figured out how to read/write to an address but I am not sure how to figure out what type of data it is for example

                                  D0 D1 D2 D3 D4 D5 D6 D7
someProgram.exe + "0x755A523D0" : 20 00 00 00 02 00 00 00
                                  D8 D9 DA DA DB DC DE DF
someProgram.exe + "0x755A523D8" : 14 00 00 00 04 00 00 00

I am using a third party memory viewer to find these values so that I can test results against my program.

The two address above hold 4 Integers easy to search for just scan every 4 bytes and convert it to an Integer but where it gets more tricky is if I have the following addresses

                                  D0 D1 D2 D3 D4 D5 D6 D7
someProgram.exe + "0x755A523D0" : 20 00 00 00 02 00 00 00
                                  D8 D9 DA DA DB DC DE DF
someProgram.exe + "0x755A523D8" : 14 00 00 00 04 00 00 00

Just to prove my point they are exactly the same as above addresses but they are not Integers they are Longs

It could also be storing 4 shorts 8 bytes or a combination of Types.

Would it be possible to detect what the value Type is and read in the correct values with JNA?

code snippet of read memory

public static int[] ReadMyProcessMemory(Pointer ProcessToReadFrom, int AdressToReadFrom, int NumberOfBytesToRead)
    {
        //Make the Desired Functions available
        Kernel32 Kernel32dll = Kernel32.INSTANCE;

        int offset = AdressToReadFrom;
        IntByReference baseAddress = new IntByReference();
        baseAddress.setValue(offset);
        Memory outputBuffer = new Memory(NumberOfBytesToRead);

        boolean reader = Kernel32dll.ReadProcessMemory(ProcessToReadFrom, offset, outputBuffer, NumberOfBytesToRead, null);

        if (reader)
        {
            //Process the received Data
            byte[] bufferBytes = outputBuffer.getByteArray(0, NumberOfBytesToRead);

            //Who wants signed byte? NOONE ! Lets convert it to a nice int !

            int[] realvalues = new int[bufferBytes.length];

            for (int i = 0; i < bufferBytes.length; i++)
            {
                if (bufferBytes[i] < 0)
                {
                    realvalues[i] = 256 + bufferBytes[i];
                }
                else
                {
                    realvalues[i] = bufferBytes[i];
                }
            }
            //Conversion done ! lets Return the data (Remember its integer not hex)
            return realvalues;

        }
        else
        {
            //Reading went wrong - SHIT
            return null;
        }
    }

public interface Kernel32 extends StdCallLibrary
    {
        Kernel32 INSTANCE = (Kernel32) Native.loadLibrary("kernel32", Kernel32.class);

        boolean ReadProcessMemory(Pointer hProcess, int inBaseAddress, Pointer outputBuffer, int nSize, IntByReference outNumberOfBytesRead);

        public Pointer OpenProcess(int dwDesiredAccess, boolean bInheritHandle, int dwProcessId);

        boolean WriteProcessMemory(Pointer hProcess, int AdressToChange, Pointer ValuesToWrite, int nSize, IntByReference irgendwas);

        int GetLastError();

        //Needed for some Windows 7 Versions
        boolean EnumProcesses(int[] ProcessIDsOut, int size, int[] BytesReturned);

        int GetProcessImageFileNameW(Pointer Process, char[] outputname, int lenght);
    }
1

There are 1 answers

2
deviantfan On

No, without further information about the types (somewhere in the memory) this is not possible