Reading the value at

Question

I am trying to create a program that reads a value at a specific address. I have it:

int _tmain(int argc, _TCHAR* argv[]) { int *address; address = (int*)0x00000021; cout << *address; return 0; } 

But this gives a reading violation error. What am I doing wrong? Thanks

Answer 1

You can use a pointer pointing to the actual object.

If you do not have an object at 0x00000021 , this will not work.

If you want to create an object in free storage (heap), you need to do this using new :

 int* address = new int; *address = 42; cout << *address; delete address; 

Answer 2

This reads the value at this address within the process’s own space. You will need to use other methods if you want to read another process space or physical memory.

Answer 3

This opens up some kind of question what exactly OlyDbg shows you. 32-bit (and 64-bit) Windows uses virtual memory, which means that the address you use in your program does not match the address actually sent on the bus to the memory chips. Instead, Windows (and I must add that other OSs, such as Linux, MacOS, * bsd, etc., do roughly the same thing) sets up some tables that say (essentially) when the program uses the address in this range, use this range of physical addresses.

This mapping is performed on each page (where each page is usually 4 KB, although other sizes are possible). In this table, he can also mark the page as “no” - this is what supports paging memory to disk. When you try to read a page marked as not, the CPU throws an exception. The OS then handles this exception by reading the data from the disk into the memory block and updating the table to say that the data is present on the physical address of X. Along with non-existing tables, they support several other values, such as read-only, so you can read, not writing down some addresses.

Windows (again, like other OSs) sets up tables for the first part of the address space, but DOES NOT associate any memory with them. From the point of view of the user program, these addresses simply should never be used.

This brings us back to my uncertainty about what OlyDbg gives when you ask him to read at 0x21. This address simply does not refer to any real data - it never was and never will be.

What others say is also true: the debugger usually uses some OS features (for example, ReadProcessMemory and WriteProcessMemory , among others on Windows) to gain access to things that you cannot read or write directly. They will allow you to read and write memory to another process that cannot be directly accessed by a regular pointer. None of them would help in reading from address 0x21, although this address does not refer to any real memory in any process.

Answer 4

When your program runs on an operating system that provides virtual memory (Windows, * nix, OS X) Not all addresses are supported by memory. A processor supporting virtual memory uses something called Page Tables to control which address refers to memory. The size of a single page is usually 4096 bytes, but this may change and is likely to be larger in the future.

The API that you use to query page tables is not part of the standard C / C ++ runtime, so you will need to use certain operating system functions to know which addresses are OK to read, and what will cause the malfunction. On Windows, you should use VirtualQuery to find out if a given address can be read, written, executed, or any / none of the above.

Answer 5

You cannot just read data from an arbitrary address in memory.