• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 2526
  • Last Modified:

[Delphi] Readprocessmemory and openprocess.

hi what is wrong with my code:
Readprocessmemory:
library dll;

uses
  SysUtils,
  Classes,
  windows;

var
    DblWord: DWORD;
    hHandle: THandle;

procedure DllMain(reason: integer) ;
begin 
   case reason of
      DLL_PROCESS_ATTACH:
      begin 
         hHandle:=LoadLibrary('Kernel32.dll');
         DblWord:=DWORD(GetProcAddress(hHandle,'ReadProcessMemory'))+5;
      end; 
      DLL_PROCESS_DETACH:
      begin
         FreeLibrary(hHandle); 
      end;
   end; 
end;

function myReadProcessMemory(hProcess: THandle; const lpBaseAddress: Pointer; lpBuffer: Pointer; nSize: DWORD; var lpNumberOfBytesRead: DWORD): BOOL;
begin
 asm
      mov edi,edi
      push ebp
      mov esp,ebp
      jmp [DblWord]
   end;
end;

exports myReadProcessMemory;

begin 
   DllProc := @DllMain; 
   DllProc(DLL_PROCESS_ATTACH) ; 
end.

Open in new window


OpenProcess:
library open;

uses
  SysUtils,
  Classes,
  windows;

var
    DblWord: DWORD;
    hHandle: THandle;

procedure DllMain(reason: integer) ;
begin 
   case reason of
      DLL_PROCESS_ATTACH:
      begin 
         hHandle:=LoadLibrary('Kernel32.dll');
         DblWord:=DWORD(GetProcAddress(hHandle,'OpenProcess'))+5;
      end; 
      DLL_PROCESS_DETACH:
      begin
         FreeLibrary(hHandle); 
      end;
   end; 
end;

function myOpenProcess(dwDesiredAccess: DWORD; bInheritHandle: Boolean; dwProcessId: DWORD): DWORD;
begin
   asm
      mov edi,edi 
      push ebp 
      mov esp,ebp 
      jmp [DblWord]
   end; 
end;

exports myOpenProcess;

begin 
   DllProc := @DllMain; 
   DllProc(DLL_PROCESS_ATTACH) ; 
end.

Open in new window


Using:
function myReadProcessMemory(hProcess: THandle; const lpBaseAddress: Pointer; lpBuffer: Pointer; nSize: DWORD; var lpNumberOfBytesRead: DWORD): BOOL; stdcall external 'Read.dll' name 'myReadProcessMemory';
function myOpenProcess(dwDesiredAccess: DWORD; bInheritHandle: Boolean; dwProcessId: DWORD): DWORD; stdcall external 'Open.dll' name 'myOpenProcess';

Open in new window


myReadProcessMemory is working fine, but myOpenProcess gives AV when i try to use it.
AV message:
Project Peeper.exe raised exception class EAccessViolation with message 'Access violation at address 00000000. Read of address 00000000'. Process stopped. Use Step or Run to continue.

What is wrong? Please help
0
l3m0n
Asked:
l3m0n
  • 3
  • 2
  • 2
1 Solution
 
systanCommented:
What application you are doing?   From all your previous post that I see until now is open,  I think your building an anti-virus.

Getting function names used by an application or a library?   ////possible using asm, but your test is wrong, why? because your testing your own application.
Getting application signatures from memory ? //possible by Delphi alone.

I doubt you are making an av, or if not, your making some malicious code.

Please explain what application you're trying to do
0
 
l3m0nAuthor Commented:
i need to open game written by my friend in c++ it is a multi player game but now he is only testing it. I said him that he must "block" functions like: "readprocessmemory" etc. He done it, but i saw that i can read something from memory using this code, but i have problem with do OpenProcess and i dont know why. Could you help me? When i done it maybe i can help with do protection.
0
 
systanCommented:
jimyX, Ewangoya, Thommy and Geert is the most active user here in Delphi zone as I noticed it,  and you can view it on the overall Delphi zone experts.

So, I think they are the one whos caplable of helping you deep.
0
Concerto's Cloud Advisory Services

Want to avoid the missteps to gaining all the benefits of the cloud? Learn more about the different assessment options from our Cloud Advisory team.

 
huacatCommented:
The library's declare without stdcall indicator but the using code have "stdcall".
0
 
l3m0nAuthor Commented:
it isnt make differences.
0
 
huacatCommented:
I add the stdcall to the DLL export declare, and it works fine.
When I remove the stdcall indicator, it give the AV error.

I create the test projects, please see attached files.
 Test.zip
0
 
l3m0nAuthor Commented:
it is working thanks
0

Featured Post

Technology Partners: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

  • 3
  • 2
  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now