Scan through process' memory
Posted on 2004-04-22
I wanted to learn all about memory and thus like I usually do when I want to learn something I make a program that does something using it.
Now I'm making something like Tsearch, I'm learning threads, processes and their memory. My program is to scan through the memory of another process given a certain string or value. Don't worry, I won't hack with it - or I would've used Tsearch instead...
Anyway, I'm now using Toolhelp23 functions and ReadProcessMemory to read a process' memory and search a value. After a lot of hassle and searching around I got to find partly the results that Tsearch finds, only tons of others in addition. For example, when I let my program search through CreateCD's process for value 167 (2 bytes), it finds 320 matches when I go through all of its modules and read their memory. Tsearch though finds only 92 matches.
When I listed my program's results in a file and I compared them I found that a good 75 out of 92 addresses that Tsearch returned were also among mine.
At first I thought that the explanation was that Tsearch knows from what point on the memory isn't used by the program, and mine doesn't, but that doesn't explain why Tsearch finds matches that I don't. I also tried to include a heap search in my program by enumerating all of a process' heaps and search them, but that didn't help. Most of it is all zero.
So my question is, how do I exactly and effectively find and get access to the memory used by a process, so that I can search through it? Am I on the right way? If yes, what should I change?
Thank you very much in advance.