C# How to modify a string from process memory

[Fr4x]

I want to find a string from a process memory and change it through C#.

My current code to modify the string via its address:

[DllImport("kernel32.dll")] public static extern IntPtr OpenProcess(int dwDesiredAccess, bool bInheritHandle, int dwProcessId); [DllImport("kernel32.dll", SetLastError = true)] static extern bool WriteProcessMemory(int hProcess, int lpBaseAddress, byte[] lpBuffer, int dwSize, ref int lpNumberOfBytesWritten); private void button1_Click(object sender, EventArgs e) { var process = Process.GetProcessesByName("ProcessName").FirstOrDefault(); IntPtr processHandle = OpenProcess(0x1F0FFF, false, process.Id); int bytesWritten = 0; byte[] buffer = Encoding.Unicode.GetBytes("It works!\0"); WriteProcessMemory((int)processHandle, 0x02C45B54 /* string address in memory */, buffer, buffer.Length, ref bytesWritten); }

My code is working perfectly but I want to modify the string from memory without knowing its memory address so this code is not useful for me.

I attached an assembly so you can do your tries on it.

EditMyMemory.exe

 

I would be grateful if someone could guide me on how to do this (I am a bit of an amateur please explain in full).

Edited August 31, 2021 by Fr4x
uploaded attachment

[Kurapica]

If it's not protected or packed then strings will be located in the .text section wherever this section is mapped in memory.

all you need is to find the scan the process memory for any occurrences of that string and then patch it correctly giving attention to the length of that string.

https://reverseengineering.stackexchange.com/questions/22130/how-to-find-the-starting-address-of-text-section-of-a-dll-inside-a-process-64

Edited August 31, 2021 by Kurapica

[Fr4x]

1 hour ago, Kurapica said:

If it's not protected or packed then strings will be located in the .text section wherever this section is mapped in memory.

all you need is to find the scan the process memory for any occurrences of that string and then patch it correctly giving attention to the length of that string.

https://reverseengineering.stackexchange.com/questions/22130/how-to-find-the-starting-address-of-text-section-of-a-dll-inside-a-process-64

Hi, thank you very much for your answer, but as I said, I'm a bit of an amateur and I need a sample code to edit it..