Search code examples
c++windowsmsdnreadprocessmemory

ReadProcessMemory on a 64 bit proces always returns Error 299


I'm having some trouble with ReadProcessMemory My code is 64 bit I can read the memory of any 32 bit process , but ReadProcessMemory always fails with error code 299 (Partial read) returning 0 bytes read.

Done my research and most answers were relate to privilges , but I have Debugging token enabled and running as admin , The address i read the the ImageBase in the PE optional header

I tried to check the page status using VirtualQueryEx and got access denied!

Note : The code runs perfectly on any 32 bit process.

Any Ideas what maybe be causing this ?

HANDLE hProcess;
DWORD pid;
EnableDebugPriv();
pid=GetProcessByName("winmine.exe"); //32 bit apps work
//pid=GetProcessByName("notepad.exe"); //64 bit apps dont
hProcess = OpenProcess(PROCESS_ALL_ACCESS ,0, pid);
if(!hProcess)
{
    printf("failed to acquire handle , Error %d \n" , GetLastError());
    return FAILED;
}


//DEBUGGING
//DWORD address =   0x100000000; //64 notepad
DWORD address =  0x1000000; // 32 bit minsweeper
DWORD oldProtect=0;
printf("DEBUG pid %d - last err :%d \n" , GetProcessId(hProcess) , GetLastError() );
if(VirtualProtectEx(hProcess , (LPVOID)address,4096 /*pagesize for test*/ , PAGE_EXECUTE_READWRITE , &oldProtect))
{
    cout <<"vp done \n";
}
else cout << " vp err :" << GetLastError() << endl;
PMEMORY_BASIC_INFORMATION pmbi = new MEMORY_BASIC_INFORMATION;
if(VirtualQueryEx(hProcess,(LPVOID)address,pmbi,sizeof(MEMORY_BASIC_INFORMATION)))
{
    cout << "protection :" << pmbi->AllocationProtect << endl;
}
char value = 0;
SIZE_T * pbytes = new SIZE_T ;
ReadProcessMemory(hProcess,(LPCVOID)address ,&value,sizeof(value),pbytes);
cout << value << endl;
printf("Read status : %d ; bytes read %d  \n",GetLastError() , *pbytes );
CloseHandle(hProcess);

Solution

  • So after some debugging and research it turned out the problem was with ASLR so i was reading from a wrong base , thanks for the help :)