ReadProcessMemory() Function

[David19]

do you have to provide the address where you want to read or are there any means of getting memory addresses location used by the process to read?

[Igor Vartanov]

Your question is about well documented ReadProcessMemory. Can I ask you, what part of the article looks not clear to you?

lpBaseAddress [in]

A pointer to the base address in the specified process from which to read. Before any data transfer occurs, the system verifies that all data in the base address and memory of the specified size is accessible for read access, and if it is not accessible the function fails.

[David19]

Yes my question is, How would you know about the memory used by process and derive the base address from it?

[Igor Vartanov]

If you explain what you intend to accomplish, possible you'll be advised on that.

[David19]

I want to read the icon position on my desktop in win32 application because someone advised me to read the listview memory within the explorer.exe so I was trying to figured out how the readprocessmemory function works.

[Igor Vartanov]

The main thing with the scenario you described is that list view control must be provided with some address in explorer process address space to let it be able to write the data.

So, having this in mind, you have to follow the main pattern of how normal application works: allocate some memory enough for write operation inside the remote process (by means of VirtualAllocEx), provide that address in a message to list view control, and after successful call, read remote memory to your process. And do not forget to free the allocated remote memory (VirtualFreeEx).