 |
Cheat Engine The Official Site of Cheat Engine
|
| View previous topic :: View next topic |
| Author |
Message |
irql_not_less_or_equal How do I cheat?
Reputation: 0
Joined: 06 Apr 2014 Posts: 2
|
Posted: Mon Apr 07, 2014 3:08 am Post subject: [C#] Cannot read memory (access is denied) |
|
|
I've been using CheatEngine to find addresses and then writing my own c# program to read values and display them in my own form; I only use ReadProcessMemory() since I'm only interested in reading.
This all worked fine until the game released an update that somehow manages to block my program from reading its memory; in fact, I can't even open a valid handle to it. The most bizarre part is that CheatEngine is unaffected and continues to read stuff like a pro.
My program works like this:
1. Require administrator privileges via application manifest
2. Set SeDebugPrivileges() by using Process.EnterDebugMode()
3. Get a list of processes by using Process.GetProcessesByName()
4. Open a handle to memory via OpenProcess() with PROCESS_WM_READ and the PID from the Process object
The problem I encounter is that OpenProcess() always returns 0, even if I use PROCESS_ALL_ACCESS. Furthermore, I noticed several properties in the Process object returned by GetProcessesByName() give an ACCESS_IS_DENIED error, including "Handle" and "MainModule.BaseAddress", both of which I need for my purposes.
I tried my code on csrss.exe instead, and it worked fine. As such, I'm at a lost as to how to fix my code, but I know it must be possible since CheatEngine is able to do it.
Oh btw, I tested this both on Windows 7 and 8.1, same results.
Here's my sample code:
| Code: |
[DllImport("kernel32.dll")]
public static extern IntPtr OpenProcess(int dwDesiredAccess, bool bInheritHandle, int dwProcessId);
[DllImport("kernel32.dll")]
public static extern bool ReadProcessMemory(int hProcess,
int lpBaseAddress, byte[] lpBuffer, int dwSize, ref int lpNumberOfBytesRead);
const int PROCESS_WM_READ = 0x0010;
void main()
{
//not shown, but the program will require admin privileges to run
Process.EnterDebugMode();
Process[] arrProcess = Process.GetProcessesByName("my_exe_name");
//for simplicity, let's assume we found 1 instance
IntPtr myWinHandle = arrProcess[0].Handle;
//this line will error with ACCESS_IS_DENIED
int myBaseAddress = arrProcess[0].MainModule.BaseAddress.ToInt32();
//this line will error with ACCESS_IS_DENIED
IntPtr myMemHandle = OpenProcess(PROCESS_WM_READ, false, arrProcess[0].Id);
//this line will not error, but will return 0; PID verified to be correct
}
|
|
|
| Back to top |
|
 |
Dark Byte Site Admin
Reputation: 471
Joined: 09 May 2003 Posts: 25823 Location: The netherlands
|
Posted: Mon Apr 07, 2014 5:06 am Post subject: |
|
|
Is your debugger running as admin ?
Have you confirmed that your process has SeDebugPrivilege (check with process explorer)
And do you have kernelmode openprocess selected in ce or not ?
_________________
Do not ask me about online cheats. I don't know any and wont help finding them.
Like my help? Join me on Patreon so i can keep helping |
|
| Back to top |
|
 |
irql_not_less_or_equal How do I cheat?
Reputation: 0
Joined: 06 Apr 2014 Posts: 2
|
Posted: Mon Apr 07, 2014 11:22 am Post subject: |
|
|
| Dark Byte wrote: | Is your debugger running as admin ?
Have you confirmed that your process has SeDebugPrivilege (check with process explorer)
And do you have kernelmode openprocess selected in ce or not ? |
My debugger is run as admin, yes, and I've also tried running my program without the debugger.
I've confirmed that I indeed do have debug privileges; I wouldn't have been able to open CSRSS otherwise.
I use default settings in CE, so no, it does not use kernel mode functions at all.
|
|
| Back to top |
|
 |
Dark Byte Site Admin
Reputation: 471
Joined: 09 May 2003 Posts: 25823 Location: The netherlands
|
Posted: Mon Apr 07, 2014 12:28 pm Post subject: |
|
|
Hmm weird. If the default settings of cheat engine can open it without a problem then not sure. (If it's because of access rights, then ce's default openprocess should have failed as well)
_________________
Do not ask me about online cheats. I don't know any and wont help finding them.
Like my help? Join me on Patreon so i can keep helping |
|
| Back to top |
|
 |
|
|
You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum You cannot attach files in this forum You can download files in this forum
|
|