ReadProcessMemory etc in VB6

#19 03-21-2007, 16:36

i ve read this thread several times earlier and mostly refrained from posting anything because im not that much comfortable with the language visual basic

in genearal Readprocessmemeory does not have any limits on reading only 4k and increments

if you simply want to check how big readprocessmemory can go
load ollydbg on ollydbg set a conditional breakpoint on ReadProcessmemory and log all function arguments you can see it reading

Code:

004AF16E  CALL to ReadProcessMemory from OLLYDBG.0046142B
            hProcess = 00000084 (window)
            pBaseAddress = 401000
            Buffer = 02D60020
            BytesToRead = AF000 (716800.)
            pBytesRead = NULL

i have attached an excel sheet that contains the log of all readprocessmemory address
and you can see ollydbg accessing address at ox400200 with sizes as big as ollydbg .txt section etc etc

Code:

address	data	crap
	pBaseAddress = 400200	
	pBaseAddress = 400200	
	pBaseAddress = 400200	
	pBaseAddress = 400200	
	pBaseAddress = 400200	
	pBaseAddress = 400200	
	pBaseAddress = 400200	
	pBaseAddress = 400200	
	pBaseAddress = 400200	
	pBaseAddress = 400200	
	pBaseAddress = 400200	

address	data	crap
	BytesToRead = 10CB (4299.)