Skip to main content
AI Assist is now on Stack Overflow. Start a chat to get instant answers from across the network. Sign up to save and share your chats.

Yes, the possibility exists. First of all You have to access any process memory, or better, make it "accessible". Then You can read memory. Here are some usefull links ( by the way, You should always look in there, if You come from linux and try to do things on windows, it is the main source ).

https://msdn.microsoft.com/en-us/library/windows/desktop/ms680553%28v=vs.85%29.aspx

https://msdn.microsoft.com/en-us/library/windows/desktop/aa366916%28v=vs.85%29.aspx

There is all documented.

But ther are also undocumented approaches, really crazy stuff, which also deals whith this topic.Like this for example.

http://undocumented.ntinternals.net/source/usermode/undocumented%20functions/memory%20management/virtual%20memory/ntreadvirtualmemory.htmlhttp://undocumented.ntinternals.net/UserMode/Undocumented%20Functions/Memory%20Management/Virtual%20Memory/NtReadVirtualMemory.html

Yes, the possibility exists. First of all You have to access any process memory, or better, make it "accessible". Then You can read memory. Here are some usefull links ( by the way, You should always look in there, if You come from linux and try to do things on windows, it is the main source ).

https://msdn.microsoft.com/en-us/library/windows/desktop/ms680553%28v=vs.85%29.aspx

https://msdn.microsoft.com/en-us/library/windows/desktop/aa366916%28v=vs.85%29.aspx

There is all documented.

But ther are also undocumented approaches, really crazy stuff, which also deals whith this topic.Like this for example.

http://undocumented.ntinternals.net/source/usermode/undocumented%20functions/memory%20management/virtual%20memory/ntreadvirtualmemory.html

Yes, the possibility exists. First of all You have to access any process memory, or better, make it "accessible". Then You can read memory. Here are some usefull links ( by the way, You should always look in there, if You come from linux and try to do things on windows, it is the main source ).

https://msdn.microsoft.com/en-us/library/windows/desktop/ms680553%28v=vs.85%29.aspx

https://msdn.microsoft.com/en-us/library/windows/desktop/aa366916%28v=vs.85%29.aspx

There is all documented.

But ther are also undocumented approaches, really crazy stuff, which also deals whith this topic.Like this for example.

http://undocumented.ntinternals.net/UserMode/Undocumented%20Functions/Memory%20Management/Virtual%20Memory/NtReadVirtualMemory.html

Source Link
icbytes
  • 1.9k
  • 1
  • 17
  • 35

Yes, the possibility exists. First of all You have to access any process memory, or better, make it "accessible". Then You can read memory. Here are some usefull links ( by the way, You should always look in there, if You come from linux and try to do things on windows, it is the main source ).

https://msdn.microsoft.com/en-us/library/windows/desktop/ms680553%28v=vs.85%29.aspx

https://msdn.microsoft.com/en-us/library/windows/desktop/aa366916%28v=vs.85%29.aspx

There is all documented.

But ther are also undocumented approaches, really crazy stuff, which also deals whith this topic.Like this for example.

http://undocumented.ntinternals.net/source/usermode/undocumented%20functions/memory%20management/virtual%20memory/ntreadvirtualmemory.html