How can you access memory of another process and call its functions?

Question

I want to learn how to read other processes memory and have my program call the other processes functions and what not with my own parameters and stuff. I've googled it and it seems like you need to use things like ReadProcessMemory but I haven't been able to find any good tutorials explaining how to use them. Could anyone point me in the right direction to learn things like this? I want to do it in C++ (or java if possible) on Windows (7 and 64bit if that matters).

Also, I know this sounds subjective and could be used for malicious purposes, but I guarantee that I will not use any knowledge gained from this for any harmful reasons. I purely want to learn this for fun and to teach myself something new.

Answer 1

You can't directly call functions in other processes, because your process and the other process have different address spaces. One way to get around this is by creating a remote thread in the process (using CreateRemoteThread or RtlCreateUserThread), but that only allows you to pass in one parameter to the function. You could try creating a remote thread, writing the parameters to its stack and changing its registers using SetThreadContext. Another way is to inject your own DLL which calls the function.

Another problem is locating the function to call. You would probably need to load symbols for EXEs or DLLs where the function you need isn't exported.

For general questions about Windows internals, try asking on Sysinternals Forums.

EDIT: What you've stated (reading a string which the process checks against user input) is very difficult to do in a program without knowing the layout of the instructions and data in the image file beforehand. If for example you have a crackme program, you would either use a static analysis tool like IDA Pro or run the program under a debugger. Either way, these things usually require human input and are difficult to do automatically.

Answer 2

Processes, by design and by definition, are isolated from each other. They have separate address space.

The operating system keeps its processes separated and allocates the resources they need so that they are less likely to interfere with each other ...

They can certainly communicate, but only if they choose to, through some form of inter-process communication.

However, threads, sometimes known as lightweight process, share their address space and can read each others' data structures.

Not sure, what you meant by

call the other processes functions

A function f() can be compiled into multiple processes' executable code. Process A and process B can call f() independently in their context.

Otherwise, process A can "communicate" to process B to perform some action, which for example may be implemented in function g() in B. B can execute it in its context and "communicate" the result back to A.

Answer 3

I cannot see any beneficial use of this, but anyway. There are at least two ways to make another process call something:

1) CreateRemoteThread(), will create a thread in a process.

2) QueueUserAPC() will make an existing thread in that process call a callback function.

If ASLR is disabled, then it's enough to call a function without parameters. Else you'll also need VirtualQueryEx(), ReadProcessMemory() and WriteProcessMemory().

Yes, and it's not something to do in java :)