Solved

OpenProcess to READ and WRITE , in windows XP

Posted on 2003-11-15
10
456 Views
Last Modified: 2013-12-25
i am trying to open a process by PID in windows XP to change some values like we normally do in HEXEDITOR , but the program is having an error when i get to
hProcess = OpenProcess ( PROCESS_ALL_ACCESS,FALSE,PID)
it means not being able to handle a process , am sure about the PID .
can any one help me to solve this problem , please.
thank you
0
Comment
Question by:fadixp
  • 5
  • 4
10 Comments
 
LVL 3

Expert Comment

by:NBrownoh
ID: 9757909
why not set the inherit value to true?
0
 
LVL 2

Author Comment

by:fadixp
ID: 9757918
i tried still not able to handle the process please send me the full code of changing any process
to accept the answer , and to earn the 500 =)
0
 
LVL 3

Expert Comment

by:NBrownoh
ID: 9757922
'Declare this in a variable
Public Declare Function OpenProcess Lib "Kernel32.dll" (ByVal dwDesiredAccessas As Long, ByVal bInheritHandle As Long, ByVal dwProcId As Long) As Long
Public Const STANDARD_RIGHTS_REQUIRED As Long = &HF0000
Public Const SYNCHRONIZE As Long = &H100000
Public Const PROCESS_ALL_ACCESS As Long = (STANDARD_RIGHTS_REQUIRED Or SYNCHRONIZE Or &HFFF)

'Do this in a button or something
'Private Sub Command1_Click()
    Ret = OpenProcess(PROCESS_ALL_ACCESS, 0, 3932)
    MsgBox Ret
'End Sub

'--

Basically if the number in the msgbox isnt zero then it worked and that is the handle to your process that you wanna edit, if it is zero then you could use getlasterror, another API call to see what happened.  i just tested this on my machine and it works.  i also have administrative rights on my account.
0
 
LVL 3

Expert Comment

by:NBrownoh
ID: 9757923
oh yeah, change 3932 to your PID, 3932 was VB6.exe's PID on my comp right now, and it worked just fine.
0
Do You Know the 4 Main Threat Actor Types?

Do you know the main threat actor types? Most attackers fall into one of four categories, each with their own favored tactics, techniques, and procedures.

 
LVL 2

Author Comment

by:fadixp
ID: 9757979
some how its about to work but i still dont know how to read and write .
0
 
LVL 2

Author Comment

by:fadixp
ID: 9757982
i mean like ( ReadProcessMemory ) and ( WriteProcessMemory )
i couldnt understand it .
0
 
LVL 3

Accepted Solution

by:
NBrownoh earned 500 total points
ID: 9757995
i dont see any API calls to write process memory, there is a function:

Declare Function GetProcessMemoryInfo Lib "PSAPI.DLL" (ByVal hProcess As Long, ppsmemCounters As PROCESS_MEMORY_COUNTERS, ByVal cb As Long) As Long

that will get information on the process memory usage. it will return data in this structure:

Type PROCESS_MEMORY_COUNTERS
    cb As Long
    PageFaultCount As Long
    PeakWorkingSetSize As Long
    WorkingSetSize As Long
    QuotaPeakPagedPoolUsage As Long
    QuotaPagedPoolUsage As Long
    QuotaPeakNonPagedPoolUsage As Long
    QuotaNonPagedPoolUsage As Long
    PagefileUsage As Long
    PeakPagefileUsage As Long
End Type

but the only thing you can do to a process is set its priority or close the process itself.  What exactly are you trying to do?
0
 
LVL 2

Author Comment

by:fadixp
ID: 9758001
actually you deserve the 500 for the time you wasted to solve this probelm
if you have an email i will send you the VB project that i found over the net and i am trying to make it working .

mine is : <removed by PashaMod for users privacy>
0
 
LVL 3

Expert Comment

by:NBrownoh
ID: 9758003
k, i sent you an email.
0

Featured Post

6 Surprising Benefits of Threat Intelligence

All sorts of threat intelligence is available on the web. Intelligence you can learn from, and use to anticipate and prepare for future attacks.

Join & Write a Comment

The debugging module of the VB 6 IDE can be accessed by way of the Debug menu item. That menu item can normally be found in the IDE's main menu line as shown in this picture.   There is also a companion Debug Toolbar that looks like the followin…
I was working on a PowerPoint add-in the other day and a client asked me "can you implement a feature which processes a chart when it's pasted into a slide from another deck?". It got me wondering how to hook into built-in ribbon events in Office.
As developers, we are not limited to the functions provided by the VBA language. In addition, we can call the functions that are part of the Windows operating system. These functions are part of the Windows API (Application Programming Interface). U…
Get people started with the process of using Access VBA to control Outlook using automation, Microsoft Access can control other applications. An example is the ability to programmatically talk to Microsoft Outlook. Using automation, an Access applic…

760 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

20 Experts available now in Live!

Get 1:1 Help Now