Reading Memory for Anticheat

[R0SsAN]

Hi, me and a friend of mine are doing an anticheat tool but we have some problems..
We wanted to create an autoscan that automatically takes all the strings present in all the memory addresses assigned to a specific process and insert them in a string and then filter them to see if there are any residual cheat strings among them.
We managed to find a way to quickly filter a string but we cannot understand how to take all the strings of a process from memory…. We tried with the ReadProcessMemory but with that we can only take the string at a certain address in the memory ..
Can you help us?
Thanks

[dhayden]

If you copy then entire process space into a string, you will double the process space. Why not scan the process space directly instead of putting it into a string?

The C++ standard doesn't provide a way to example the entire address space. Keep in mind that may be (in fact, probably will be) disjoint: the data may occupy one range of address, then there may be unmapped (aka illegal to access) addresses, then stack, then unmapped, then the heap, then unmapped, then the instructions, then unmapped, then various shared libraries....

The point here is that you really need to look this up the Operating system documentation.

[Ganado]

Sounds like Rossan already did look up OS documentation (ReadProcessMemory). I would reply more if I knew more, but I don't. All the resources I can find all point to ReadProcessMemory, so perhaps something is still being set up wrong with respect to those API calls.

(I imagine that making a call to read memory from another program requires you to be running as an administrator, maybe that's one issue here)

Edit: Another user was also just recently having issues with ReadProcessMemory, see: http://cplusplus.com/forum/beginner/269504/