Search code examples
c#readprocessmemory

c# kernel32.dll readprocessmemory windows 11 returns error 299

I've implemented the ReadProcessMemory function from kernel32.dll using C# PInvoke. Compiling and installing on Windows 10 it functions flawlessly. However, installing the same program in Windows 11, it throws error 299 both in running with administrator privileges and not.

Here is the c# code:

[DllImport("kernel32.dll", SetLastError = setLastError)]
[return: MarshalAs(UnmanagedType.Bool)]
public static extern bool ReadProcessMemory(
    [In] IntPtr hProcess,
    [In] IntPtr lpBaseAddress,
    [Out] byte[] lpBuffer,
    [In] UIntPtr dwSize,
    [Out] out UIntPtr lpNumberOfBytesRead
);

And I use Process.Handle for hProcess. But since it works on Windows 10, the same compiled code, not recompiled I cant image it is wrong. Most likely some setting on Windows that does not allow for one process to read the memory of another process even though we are running with administrator privileges.

Solution

  • After installing the following two Windows updates:

     2024-05 .NET 8.0.5  Security Update for x64 Client (KB5038352)
 2024-05 .NET 6.0.30 Security Update for x64 Client (KB5038350)

    It works as intended on Windows 11.