Using JNA I have figured out how to read/write to an address but I am not sure how to figure out what type of data it is for example
D0 D1 D2 D3 D4 D5 D6 D7
someProgram.exe + "0x755A523D0" : 20 00 00 00 02 00 00 00
D8 D9 DA DA DB DC DE DF
someProgram.exe + "0x755A523D8" : 14 00 00 00 04 00 00 00
I am using a third party memory viewer to find these values so that I can test results against my program.
The two address above hold 4 Integers easy to search for just scan every 4 bytes and convert it to an Integer but where it gets more tricky is if I have the following addresses
D0 D1 D2 D3 D4 D5 D6 D7
someProgram.exe + "0x755A523D0" : 20 00 00 00 02 00 00 00
D8 D9 DA DA DB DC DE DF
someProgram.exe + "0x755A523D8" : 14 00 00 00 04 00 00 00
Just to prove my point they are exactly the same as above addresses but they are not Integers they are Longs
It could also be storing 4 shorts 8 bytes or a combination of Types.
Would it be possible to detect what the value Type is and read in the correct values with JNA?
code snippet of read memory
public static int[] ReadMyProcessMemory(Pointer ProcessToReadFrom, int AdressToReadFrom, int NumberOfBytesToRead)
{
//Make the Desired Functions available
Kernel32 Kernel32dll = Kernel32.INSTANCE;
int offset = AdressToReadFrom;
IntByReference baseAddress = new IntByReference();
baseAddress.setValue(offset);
Memory outputBuffer = new Memory(NumberOfBytesToRead);
boolean reader = Kernel32dll.ReadProcessMemory(ProcessToReadFrom, offset, outputBuffer, NumberOfBytesToRead, null);
if (reader)
{
//Process the received Data
byte[] bufferBytes = outputBuffer.getByteArray(0, NumberOfBytesToRead);
//Who wants signed byte? NOONE ! Lets convert it to a nice int !
int[] realvalues = new int[bufferBytes.length];
for (int i = 0; i < bufferBytes.length; i++)
{
if (bufferBytes[i] < 0)
{
realvalues[i] = 256 + bufferBytes[i];
}
else
{
realvalues[i] = bufferBytes[i];
}
}
//Conversion done ! lets Return the data (Remember its integer not hex)
return realvalues;
}
else
{
//Reading went wrong - SHIT
return null;
}
}
public interface Kernel32 extends StdCallLibrary
{
Kernel32 INSTANCE = (Kernel32) Native.loadLibrary("kernel32", Kernel32.class);
boolean ReadProcessMemory(Pointer hProcess, int inBaseAddress, Pointer outputBuffer, int nSize, IntByReference outNumberOfBytesRead);
public Pointer OpenProcess(int dwDesiredAccess, boolean bInheritHandle, int dwProcessId);
boolean WriteProcessMemory(Pointer hProcess, int AdressToChange, Pointer ValuesToWrite, int nSize, IntByReference irgendwas);
int GetLastError();
//Needed for some Windows 7 Versions
boolean EnumProcesses(int[] ProcessIDsOut, int size, int[] BytesReturned);
int GetProcessImageFileNameW(Pointer Process, char[] outputname, int lenght);
}
No, without further information about the types (somewhere in the memory) this is not possible