How to change a value in memory space of another process

Question

If you could help me with this dilemma I have. Now, I know C \ C++, I know asm, I know about dll injection, I know about virtual memory addressing, but I just can't figure out how software like CheatEngine, and others, manage to change a variable's value in another process.

For those who don't know, 3rd party cheat engine tools can scan for values in the memory space of a program and identify the location of a variable with a given value and change it.

My question is, how do they do it?

Given an address, if I were to write C code, how could I change the value at that address belonging to another process without getting an invalid addressing error?

Thanks.

Technics

Answer 1

I'm fairly certain those programs are pretending to be debuggers. On Windows, I would start with DebugActiveProcess() and go from there.

Oh, and the very useful looking ReadProcessMemory() function (and WriteProcessMemory()).

Perrie

Thanks this is what i was looking for, works great. (For others reading this solution be sure to use DebugActiveProcessStop when done) – Technics

Be sure to call DebugSetProcessKillOnExit() if you don't want the process you're debugging to die after you're done debugging it. – Reclaim

Answer 2

On unix: ptrace()

Droit

Can ptrace also modify the memory of the other process? – Gershom

As opposed to which process? – Droit

Answer 3

You can't do this with Standard C or C++ - you have to use operating system specific features. So you need to tell us which OS you are interested in.

Rant

Sorry i did not specify, i am interested in Windows, but Linux would be great to, i am curious to try it there also – Technics

Answer 4

You may also be interested in Detours:

Software packaged for detouring Win32 and application APIs.

Kweisui

Thanks read about detouring codingthewheel.com/archives/…. Fun experiment ASCII \ graffiti bomb. Too bad it's not freely \ easily available for 64 bit – Technics