Search
Module:
Directory

   Desktop Functions:

   Smart Device Functions:


Show Recent Changes
Subscribe (RSS)
Misc. Pages
Comments
FAQ
Helpful Tools
Playground
Suggested Reading
Website TODO List
Download Visual Studio Add-In

ReadProcessMemory (kernel32)
 
.
Summary

C# Signature:

  [DllImport("kernel32.dll", SetLastError = true)]
  static extern bool ReadProcessMemory(
    IntPtr hProcess,
    IntPtr lpBaseAddress,
    [Out] byte[] lpBuffer,
    int dwSize,
    out int lpNumberOfBytesRead
   );

   [DllImport("kernel32.dll", SetLastError = true)]
   static extern bool ReadProcessMemory(
    IntPtr hProcess,
    IntPtr lpBaseAddress,
    [Out, MarshalAs(UnmanagedType.AsAny)] object lpBuffer,
    int dwSize,
    out int lpNumberOfBytesRead
   );

   [DllImport("kernel32.dll", SetLastError = true)]
   static extern bool ReadProcessMemory(
    IntPtr hProcess,
    IntPtr lpBaseAddress,
    IntPtr lpBuffer,
    int dwSize,
    out int lpNumberOfBytesRead
   );

VB.Net Signature:

  <DllImport("kernel32.dll", SetLastError:=true)> _
  Public Shared Function ReadProcessMemory( _
    ByVal hProcess As IntPtr, _
    ByVal lpBaseAddress As IntPtr, _
    <Out()>ByVal lpBuffer() As Byte, _
    ByVal dwSize as Integer, _
    ByRef lpNumberOfBytesRead as Integer
  ) As Boolean
  End Function

  <DllImport("kernel32.dll", SetLastError:=true)> _
  Public Shared Function ReadProcessMemory( _
    ByVal hProcess As IntPtr, _
        ByVal lpBaseAddress As IntPtr, _
       <Out(),MarshalAs(UnmanagedType.AsAny)>ByVal lpBuffer As object, _
    ByVal dwSize as Integer, _
    ByRef lpNumberOfBytesRead as Integer _
   ) As Boolean
   End Function

   <DllImport("kernel32.dll", SetLastError:=True)> _
   Public Shared Function ReadProcessMemory( _
    ByVal hProcess As IntPtr, _
    ByVal lpBaseAddress As IntPtr, _
    ByVal lpBuffer As IntPtr, _
    ByVal iSize As Integer, _
    ByRef lpNumberOfBytesRead As Integer) As Boolean
   End Function

User-Defined Types:

None.

Notes:

Tips & Tricks:

To read primitive values without boxing pass in a byte array to read the content. Use methods in the BitConverter class to convert the data.

You can also make aliases of the signatures above to pass the variable recieving the data by reference. e.g

  <DllImport("kernel32.dll", SetLastError=true, EntryPoint="ReadProcessMemory")> _
  Public Shared Function ReadVMInteger(ByVal hProcess As IntPtr,ByVal lpBaseAddress As IntPtr,
   ByRef lpBuffer As Integer,ByVal dwSize as Integer, ByRef lpNumberOfBytesRead as Integer);

Sample Code:

Assuming you're trying to readout an integer which is four bytes long:

As you can see I prove a handle, and an adress.

I then create a new buffer the size of the adress.

(Note that this example is an integer you could also do it with strings but then return encoding.default.ascii etc.. )

public int ReadInt32(IntPtr hProcess, uint dwAddress)

    {

        byte[] buffer = new byte[4];
        int bytesread;

        Win32Api.ReadProcessMemory(hProcess, dwAddress, buffer, 4, out bytesread);
        return BitConverter.ToInt32(buffer, 0);

    }

Alternative Managed API:

Do you know one? Please contribute it!

Documentation

Please edit this page!

Do you have...

  • helpful tips or sample code to share for using this API in managed code?
  • corrections to the existing content?
  • variations of the signature you want to share?
  • additional languages you want to include?

Select "Edit This Page" on the right hand toolbar and edit it! Or add new pages containing supporting types needed for this API (structures, delegates, and more).

 
Access PInvoke.net directly from VS:
Terms of Use
Find References
Show Printable Version
Revisions