reading memory addresses

[KB1IBH]

im working on a project which involves reading of memory addresses... and i have a couple of questions i hope someone can address... i've found the memory address i want to watch in a particular process using Tsearch and Artmoney, and i have the code to actually read it, but it was always my understanding that memory addresses are very dynamic, in the sense that if you shut down and run the program again, its pretty certain that it will be a completely different address completely...am i right in this assumption? and if i am, is there any way that i would, through code be able to find the new address despite it having changed?

thanks in advance

[RaleTheBlade]

Im pretty sure your assumption about memory swapping is correct. You MIGHT get lucky and it would be the same address but its an extremely slim chance.

As for wanting to monitor an address regardless of program activity (shutdown, startup, etc...) I really dont know how you would do that... But I dont think it would be with C#. Your probably looking at a lower level language such as C.

Maybe if you could get a handle to the process and get access to its variables by some way of interop you could do it. But then it may not work anyway if the application shuts down.

[PaulMdx]

What you need to do is identify the starting memory address for the process and then work out the offset to the piece of data you're interested in. That way upon reboot you can identify the new starting address and the offset will always remain the same.

Unfortunately I'm also not much use as I don't have the code to do that, but I would hope C# offers that functionality. If not you'll find a line or two of C++ will do the job, which you can probably wrap up to access via C# if you need to.

[KB1IBH]

ok, thats what i was afraid of, i read your reply about 3 hours ago and have been searching ever sense, i haven't been able to find anything yet, so if anyone can find any code in any language that i can use to throw together a dll, it'd be greatly appreciated, i just need to be able to get the base memory address of any process, then i think i can calculate the offset.....

]

[TheCPUWizard]

A user level process (ie a normal program) can NOT read the memory addresses of another process. Period. Independant of Language.

Just think about what the security ramifications would be if this were possible....

[RaleTheBlade]

I believe it used to be possible with the old 80186 Intel based CPU's (circa 1982). They didn't have protected mode. The 80286 introduced that I think.

The 80186 CPU was also an 8-bit CPU, so basically no applications written today would run properly on it. That and its like, 20+ years old, haha.