access memory

  • Thread starter Thread starter Guest
  • Start date Start date
G

Guest

hi, this might b getting a bit too...low level but how can i check to see if
a certain memory address holds a charge?
 
iwdu15 said:
hi, this might b getting a bit too...low level but how can i check to see if
a certain memory address holds a charge?
--
Click to expand...

Are you talking about virtual address (i.e. in a process context) or
physical memory?
physical addresses can only be used in kernel space. The easiest solution is
to use a kernel debugger like WinDbg.

If you want to know the value at a virtual memory address in a process you
can also use a debugger, or do something like:

size_t the_address = 0x123456;
long * ptr = (long*) the_address;
long the_value = *ptr;

of course, since there may not be anything at that virtual address, you have
to use structured exception handling (seh) to make it safe. otherwise you can
crash your program.

--

Kind regards,
Bruno.
(e-mail address removed)
Remove only "_nos_pam"
 
sorry for not being clear...i mean like get the value of what stored at a
certain memory address....like if i give 0x123456, then it returns whats
stored at that address
 
sorry for not being clear...i mean like get the value of what stored at a
certain memory address....like if i give 0x123456, then it returns whats
stored at that address
Click to expand...

That is exactly what my example does:

size_t the_address = 0x123456; //specify a numerical value that
is to be used as an address
long * ptr = (long*) the_address; //declare a pointer that points
to the specified adress
long the_value = *ptr; //read the value that is
stored at that address.

or in shorthand:

long the_value = *(long *) 0x123456;

but you have to use SEH around this to catch possible access violations
because you don't know if you can access that address or not.
This also only works for virtual addresses. if you want to do this with
physical memory there is no choice but to write a kernel driver or use a
kernel debugger.

--

Kind regards,
Bruno.
(e-mail address removed)
Remove only "_nos_pam"
 
Back
Top