msn plus script read/write memory

Question

I'm writing on a MSN Plus script, which is in fact javascript.
For interop with Windows there is a class called Interop.
With its static function Call one can call s specified function in a specified dll with up to 12 arguments.
My goal is to write a script which gets a process name out of the PID.
I've done everything right, but it still doesn't work.

function GetProcNameFromPID(pid)  
{
    var hnd = Interop.Call("kernel32", "CreateToolhelp32Snapshot", 2, 0);
    var handle = Interop.Call("kernel32", "GetCurrentProcess");
    var StructP = Interop.Allocate(4+4+4+4+4+4+4+4+4+260);//*Allocate space for the ProcessEntry32 struct*
    var hnd_ptr = Interop.Allocate(4);
    var ress = Interop.Call("kernel32", "WriteProcessMemory", handle, StructP, StructP.size.DataPtr, 4, hnd_ptr);
    Debug.Trace(ReadInt(hnd_ptr, 0));
    var res = Interop.Call("kernel32", "Process32FirstW", hnd, StructP.DataPtr);
    if(!res)
    {
        Debug.Trace("FAAAAIIIILLLLL / " + Interop.Call("kernel32", "GetLastError") + " / " + ress);
    }
    else
    {
        do
        {
            var pos = 0;
            ReadInt(StructP, pos);
            ReadInt(StructP, pos);
            var owpid = ReadInt(StructP, pos);
            ReadInt(StructP, pos);
            ReadInt(StructP, pos);
            ReadInt(StructP, pos);
            var parpid = ReadInt(StructP, pos);
            ReadInt(StructP, pos);
            ReadInt(StructP, pos);
            ReadInt(StructP, pos);
            var name = ReadString(pos, 50);
            if(pid == owpid)
                return name;
            StructP = Interop.Allocate(4+4+4+4+4+4+4+8+4+50);
            Interop.Call("kernel32", "WriteProcessMemory", handle, StructP.DataPtr, StructP.size.DataPtr, 4, null);
        }
            while(Interop.Call("kernel32", "Process32NextW", hnd, StructP.DataPtr) == true)
    }
}
function ReadInt(buffer, pos)
{
var res = 0; 
    for(var i = 0; i >> 24;  
    var b2 = addr >> 24;  
    var b3 = addr >> 24;  
    var b4 = addr >> 24;  
    return b4 + b3*256 + b2*256*256 + b1*256*256*256;  
}  

---

The Process32FirstW function always suceeds, but the struct is empty.
The WriteProcessMemory function suceeds, too. But the number of written bytes is always 0.

Answer 1

I don't have a machine to test things on, but your first issue is you don't appear to be passing the proper parameters to WriteProcessMemory:

BOOL WINAPI WriteProcessMemory(
  __in   HANDLE hProcess,
  __in   LPVOID lpBaseAddress,
  __in   LPCVOID lpBuffer,
  __in   SIZE_T nSize,
  __out  SIZE_T *lpNumberOfBytesWritten
);

You're passing...

handle => hProcess,
StructP => lpBaseAddress, // ???
StructP.size.DataPtr => lpBuffer, // ???
4 => nSize,
hnd_ptr => lpNumberOfBytesWritten

Let's start with an overview of WriteProcessMemory: It's supposed to take a chunk of data in the curent process, pointed to by lpBuffer, nSize bytes long. It copies that data into the memory space of the process indicated by hProcess and places that data at the address lpBaseAddress in that target process.

The problems I see with your code are:

1. lpBaseAddress should be the address in another process which you are writing to. Since your handle points to the current process, I don't even know why you'd call this function to begin with. You can just use StructP.WriteWORD(Offset, Data) to write data to your structure. But I'll presume for now you're doing this for bare minimum demonstraction purposes — to see if you can get WriteProcessMemory() to work at all.

2. I don't think this is even valid code. StructP.size exists, but it's an int, not an object. It has no DataPtr member. StructP.DataPtr also exists. In fact, StructP.DataPtr is what is sent if you just specify StructP according to the help file. So are you trying to write from the structure right back to the structure, again, as a minimum test? If so, both pointers should be StructP

Following that, I don't know where the ReadInt() function you are using comes from. It looks to me like Databloc has several member functions for reading values, but you would call them like: hnd_ptr.ReadWORD(0)

I am unsurprised that the structure is empty after calling Process32FirstW(), as it checks the value of the dwSize member of the structure. Since you are not successfully writing to it, I expect that value is normally 0, and hence no data is written.

I've never fiddled with Messger Plus, so you'll have to forgive me a little for being befuddled by a lot of this. Let me know if any of this was useful.