How to change a value in memory space of another process

Question

Hi all, If you could help me with this dilemma I have. Now, I know C \ C++, I know asm, I know about dll injection, I know about virtual memory addressing, but I just can't figure out how software like CheatEngine, and others, manage to change a variable's value in another process.

For those who don't know, 3rd party cheat engine tools can scan for values in the memory space of a program and identify the location of a variable with a given value and change it.

My question is, how do they do it?

Given an address, if I were to write C code, how could I change the value at that address belonging to another process without getting an invalid addressing error?

Thanks.

Answer 1

I'm fairly certain those programs are pretending to be debuggers. On Windows, I would start with DebugActiveProcess() and go from there.

Oh, and the very useful looking ReadProcessMemory() function (and WriteProcessMemory()).

Answer 2

You can't do this with Standard C or C++ - you have to use operating system specific features. So you need to tell us which OS you are interested in.

Answer 3

For Windows, here's an amazingly detailed article about code injection techniques, which can be used as a starting point.

Answer 4

On unix: ptrace()

Answer 5

You may also be interested in Detours:

Software packaged for detouring Win32 and application APIs.

Answer 6

Hello,

Could you post code that you used that worked for you, I am interested in knowing this answer as well?