How can you access memory of another process and call its functions?

c++, windows

Solution

You can't directly call functions in other processes, because your process and the other process have different address spaces. One way to get around this is by creating a remote thread in the process (using CreateRemoteThread or RtlCreateUserThread), but that only allows you to pass in one parameter to the function. You could try creating a remote thread, writing the parameters to its stack and changing its registers using SetThreadContext. Another way is to inject your own DLL which calls the function.

Another problem is locating the function to call. You would probably need to load symbols for EXEs or DLLs where the function you need isn't exported.

For general questions about Windows internals, try asking on Sysinternals Forums.

EDIT: What you've stated (reading a string which the process checks against user input) is very difficult to do in a program without knowing the layout of the instructions and data in the image file beforehand. If for example you have a crackme program, you would either use a static analysis tool like IDA Pro or run the program under a debugger. Either way, these things usually require human input and are difficult to do automatically.

Problem

I want to learn how to read other processes memory and have my program call the other processes functions and what not with my own parameters and stuff. I've googled it and it seems like you need to use things like ReadProcessMemory but I haven't been able to find any good tutorials explaining how to use them. Could anyone point me in the right direction to learn things like this? I want to do it in C++ (or java if possible) on Windows (7 and 64bit if that matters). Also, I know this sounds subjective and could be used for malicious purposes, but I guarantee that I will not use any knowledge gained from this for any harmful reasons. I purely want to learn this for fun and to teach myself something new.

Original source