Posted on 1997-11-24
I want to find a number stored somehwere in a win16 application. The way I have set out to do this is use CreateProcess in my application to start the win16 program. I then use the OpenProcess with the intention of using ReadProcessMemory. So I go through all of this only I am not finding what I should. To test the whole procedure I wrote my own simple win16 program with specific numbers on the stack and another set on the heap. I then set out to find those numbers in my test program only it didn't work. Why not? If this hasn't made sense yet read on. My search routine looked something like:
HANDLE h; // is the process handle from OpenProcess
short number; // is the number I am looking for
short chk; // 2 byte number
The idea here is since I don't know the actual size of the process memory, as soon as i becomes too big and is outside the valid process memory ReadProcessMemory will fail. So in theory (at least the way I understand it) this should check all the memory in the process, the stack and heap, and program code.
while(ReadProcessMemory(h,(void*)i,&chk,2,&readBytes) != 0)
if (chk == number)
// I just print the location here
So anyway I see it as the above code should check through everything in the program and the memory it is using. It is searching through something, it goes through about a meg of memory before ReadProcessMemory fails. But it doesn't find what it should. So, at least, its not search the stack or heap (which is what I want). So what is going on? What is it searching? And how do I get at the data I want to search?
Any thoughts/comments would be greatly appreciated.
Thanx ... Jason