Jump to content
Tuts 4 You

C# How to modify a string from process memory


Recommended Posts

I want to find a string from a process memory and change it through C#.

My current code to modify the string via its address:

[DllImport("kernel32.dll")] public static extern IntPtr OpenProcess(int dwDesiredAccess, bool bInheritHandle, int dwProcessId); [DllImport("kernel32.dll", SetLastError = true)] static extern bool WriteProcessMemory(int hProcess, int lpBaseAddress, byte[] lpBuffer, int dwSize, ref int lpNumberOfBytesWritten); private void button1_Click(object sender, EventArgs e) { var process = Process.GetProcessesByName("ProcessName").FirstOrDefault(); IntPtr processHandle = OpenProcess(0x1F0FFF, false, process.Id); int bytesWritten = 0; byte[] buffer = Encoding.Unicode.GetBytes("It works!\0"); WriteProcessMemory((int)processHandle, 0x02C45B54 /* string address in memory */, buffer, buffer.Length, ref bytesWritten); }

My code is working perfectly but I want to modify the string from memory without knowing its memory address so this code is not useful for me.

I attached an assembly so you can do your tries on it.

image.png.e8eb7b3dff58fbc53235f7b6d5311e39.png

image.png.d13cbd1a500e95e531c9a4cf7a738697.png

EditMyMemory.exe

 

I would be grateful if someone could guide me on how to do this (I am a bit of an amateur please explain in full).

Edited by Fr4x
uploaded attachment
Link to comment
Kurapica

If it's not protected or packed then strings will be located in the .text section wherever this section is mapped in memory.

all you need is to find the scan the process memory for any occurrences of that string and then patch it correctly giving attention to the length of that string.

https://reverseengineering.stackexchange.com/questions/22130/how-to-find-the-starting-address-of-text-section-of-a-dll-inside-a-process-64

Edited by Kurapica
  • Like 1
Link to comment
1 hour ago, Kurapica said:

If it's not protected or packed then strings will be located in the .text section wherever this section is mapped in memory.

all you need is to find the scan the process memory for any occurrences of that string and then patch it correctly giving attention to the length of that string.

https://reverseengineering.stackexchange.com/questions/22130/how-to-find-the-starting-address-of-text-section-of-a-dll-inside-a-process-64

Hi, thank you very much for your answer, but as I said, I'm a bit of an amateur and I need a sample code to edit it..

Link to comment

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
×
×
  • Create New...