How to read 3rd party application's variables from memory?

Question

Dears,

I'm trying to read variables from memory. Variables, that doesn't belong to my own program. For instance, let's say I have this Adobe Shockwave (.dcr) application running in browser and I want to read different variables from it. How it's being done? Do I need to hook the process? But it's running under virtual machine, so I don't know how to do it.

This task is pretty much trivial in normal w32 applications (as it is mainly just CBT-hooking / subclassing), but as I mentioned before, I've got no idea how it's being done with flash / shockwave.

I'm using C++ (VS9) as my development-environment, in case you wish to know.

Any hints would be highly appreciated, so thank you in advance.

Best regards, nhaa123

Answer 1

Hi,

without having debug Binaries/DLLs of the Apps, your only chance is asking some hackers.

Normally you can connect to a process with a debugger, but without the debugging symbols of the binaries you don't see any variable names - just memory addresses.

Further the Flash/Shockwave code runs inside a sandbox inside the browser to prevent security holes by manipulated Flash code. So you don't have a real chance to get access to the running Flash code / to the plugin executing the Flash code - except you have a manipulated version of such a plugin.

So your task is quite hard to solve without using less legal methods. The next hard thing is the virtual machine - this could be solved by implementing your app as a client/server solution, where the "inspector" / watchdog runs as server inside the virtual machine and the client requesting the variable status/content running on your normal host. The communication could be done as simple socket connection.

If you have the chance to write your own Flash/Shockwave plugin, you maybe could be able to see contents of variables.

Sorry, that I cannot help you any further.

ciao, 3DH

Answer 2

If you're trying to do it manually just for one or two experiments, it's easy. Try a tool like Cheat engine which is like a free and quick and simple process peeker. Basically it scans the process's memory space for given key values. You can then filter those initial search hits later as well. You can also change those values you do find, live. The link above shows a quick example of using it to find a score or money value in a game, and editing it live as the game runs.