-
The CsWin32 Generated ReadProcessMemory signature is: [DllImport("KERNEL32.dll", ExactSpelling = true, SetLastError = true)]
[DefaultDllImportSearchPaths(DllImportSearchPath.System32)]
[SupportedOSPlatform("windows5.1.2600")]
internal static extern unsafe winmdroot.Foundation.BOOL ReadProcessMemory(winmdroot.Foundation.HANDLE hProcess, void* lpBaseAddress, void* lpBuffer, nuint nSize, [Optional] nuint* lpNumberOfBytesRead); While I created wrapper method to read out a uintptr from process memory: private static unsafe bool UnsafeReadProcessMemory(Process process, nuint baseAddress, out nuint value)
{
byte[] buffer = new byte[8];
BOOL result;
fixed (byte* pBuffer = buffer)
{
result = ReadProcessMemory((HANDLE)process.Handle, (void*)baseAddress, &pBuffer, 8, default);
}
value = (nuint)BinaryPrimitives.ReadUInt64LittleEndian(buffer);
return result;
} It always read 0 and error code is also 0 [DllImport("kernel32.dll", EntryPoint = "ReadProcessMemory", SetLastError = true)]
private static extern bool SimpleReadProcessMemory(IntPtr hProcess, UIntPtr lpBaseAddress, [Out] byte[] lpBuffer, int dwSize, out IntPtr lpNumberOfBytesRead); and a wrapper method:
It give me a success result. |
Beta Was this translation helpful? Give feedback.
Replies: 1 comment 1 reply
-
I notice the I don't know enough about how to use this function to test it locally however. Can you provide a full console app that perhaps spawns notepad.exe and reads anything from it so I can experiment? |
Beta Was this translation helpful? Give feedback.
I notice the
dwSize
parameter type in your working example is declared asint
in your 64-bit process, but the docs and headers and win32metadata suggest it should be pointer-sized (i.e.nuint
). That's the only significant difference between your declaration and the one from CsWin32. And I'd lean toward CsWin32's being the correct one, so I'm surprised by your report that yours works and Cswin32's doesn't.I don't know enough about how to use this function to test it locally however. Can you provide a full console app that perhaps spawns notepad.exe and reads anything from it so I can experiment?