Cheat Engine Forum Index Cheat Engine
The Official Site of Cheat Engine
 
 FAQFAQ   SearchSearch   MemberlistMemberlist   UsergroupsUsergroups   RegisterRegister 
 ProfileProfile   Log in to check your private messagesLog in to check your private messages   Log inLog in 


[C#] Cannot read memory (access is denied)

 
Post new topic   Reply to topic    Cheat Engine Forum Index -> General programming
View previous topic :: View next topic  
Author Message
irql_not_less_or_equal
How do I cheat?
Reputation: 0

Joined: 06 Apr 2014
Posts: 2

PostPosted: Mon Apr 07, 2014 3:08 am    Post subject: [C#] Cannot read memory (access is denied) Reply with quote

I've been using CheatEngine to find addresses and then writing my own c# program to read values and display them in my own form; I only use ReadProcessMemory() since I'm only interested in reading.
This all worked fine until the game released an update that somehow manages to block my program from reading its memory; in fact, I can't even open a valid handle to it. The most bizarre part is that CheatEngine is unaffected and continues to read stuff like a pro.

My program works like this:
1. Require administrator privileges via application manifest
2. Set SeDebugPrivileges() by using Process.EnterDebugMode()
3. Get a list of processes by using Process.GetProcessesByName()
4. Open a handle to memory via OpenProcess() with PROCESS_WM_READ and the PID from the Process object

The problem I encounter is that OpenProcess() always returns 0, even if I use PROCESS_ALL_ACCESS. Furthermore, I noticed several properties in the Process object returned by GetProcessesByName() give an ACCESS_IS_DENIED error, including "Handle" and "MainModule.BaseAddress", both of which I need for my purposes.
I tried my code on csrss.exe instead, and it worked fine. As such, I'm at a lost as to how to fix my code, but I know it must be possible since CheatEngine is able to do it.

Oh btw, I tested this both on Windows 7 and 8.1, same results.

Here's my sample code:
Code:

[DllImport("kernel32.dll")]
public static extern IntPtr OpenProcess(int dwDesiredAccess, bool bInheritHandle, int dwProcessId);

[DllImport("kernel32.dll")]
public static extern bool ReadProcessMemory(int hProcess,
     int lpBaseAddress, byte[] lpBuffer, int dwSize, ref int lpNumberOfBytesRead);

const int PROCESS_WM_READ = 0x0010;

void main()
{
     //not shown, but the program will require admin privileges to run

     Process.EnterDebugMode();

     Process[] arrProcess = Process.GetProcessesByName("my_exe_name");

     //for simplicity, let's assume we found 1 instance

     IntPtr myWinHandle = arrProcess[0].Handle;
     //this line will error with ACCESS_IS_DENIED

     int myBaseAddress = arrProcess[0].MainModule.BaseAddress.ToInt32();
     //this line will error with ACCESS_IS_DENIED

     IntPtr myMemHandle = OpenProcess(PROCESS_WM_READ, false, arrProcess[0].Id);
     //this line will not error, but will return 0; PID verified to be correct
}
Back to top
View user's profile Send private message
Dark Byte
Site Admin
Reputation: 471

Joined: 09 May 2003
Posts: 25823
Location: The netherlands

PostPosted: Mon Apr 07, 2014 5:06 am    Post subject: Reply with quote

Is your debugger running as admin ?
Have you confirmed that your process has SeDebugPrivilege (check with process explorer)
And do you have kernelmode openprocess selected in ce or not ?

_________________
Do not ask me about online cheats. I don't know any and wont help finding them.

Like my help? Join me on Patreon so i can keep helping
Back to top
View user's profile Send private message MSN Messenger
irql_not_less_or_equal
How do I cheat?
Reputation: 0

Joined: 06 Apr 2014
Posts: 2

PostPosted: Mon Apr 07, 2014 11:22 am    Post subject: Reply with quote

Dark Byte wrote:
Is your debugger running as admin ?
Have you confirmed that your process has SeDebugPrivilege (check with process explorer)
And do you have kernelmode openprocess selected in ce or not ?

My debugger is run as admin, yes, and I've also tried running my program without the debugger.
I've confirmed that I indeed do have debug privileges; I wouldn't have been able to open CSRSS otherwise.
I use default settings in CE, so no, it does not use kernel mode functions at all.
Back to top
View user's profile Send private message
Dark Byte
Site Admin
Reputation: 471

Joined: 09 May 2003
Posts: 25823
Location: The netherlands

PostPosted: Mon Apr 07, 2014 12:28 pm    Post subject: Reply with quote

Hmm weird. If the default settings of cheat engine can open it without a problem then not sure. (If it's because of access rights, then ce's default openprocess should have failed as well)
_________________
Do not ask me about online cheats. I don't know any and wont help finding them.

Like my help? Join me on Patreon so i can keep helping
Back to top
View user's profile Send private message MSN Messenger
Display posts from previous:   
Post new topic   Reply to topic    Cheat Engine Forum Index -> General programming All times are GMT - 6 Hours
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Powered by phpBB © 2001, 2005 phpBB Group

CE Wiki   IRC (#CEF)   Twitter
Third party websites