Memory scan

[lare26]

I am trying to scan memory a through b. But I am getting issues with lvalues.

#include <iostream>

using namespace std;

void scan(int start, int stop)
{
    do
    {
    int = memstop, memstart;
    int &memstart = start;
    int &memstop = stop;
        cout << memstart;
        &memstart += 1;
    }
    while (&memstart < (&memstop + 1));
        }

        int main()
{
    scan(1,10);
    return 0;
}

[Albatross]

@Lines 9, 10, and 11: What... are you trying to do there? O_o

-Albatross

[Computergeek01]

You can't call "main()" from within the program.

[Albatross]

I don't think he does. The tabs are a bit confusing, I'll admit, but there's only one main() there. ;)

-Albatross

[Computergeek01]

Ok I see it now, "void scan(...)" ends on line 16.

As for what they're doing, it looks like trying to output the data held at addresses 1 - 10?

@ OP: What are you scanning the memory for exactly? Also what platform are you on? There may be a more effective function to do this, unless of course this is educational\experimental.

[userulluipeste]

First of all, when you're referring to memory addresses, you don't use something other than pointers. I see you're using int values. Though this might work on 32-bit platforms since int size and pointer size happen to be the same, you should expect problems even with such simple function that does an elementary memory read. These functions won't work on 16-bit platforms (a history for most of you) or 64-bit or higher (a present and a future for all of us).
Second, your code is buggy. What "int = memstop" does mean? Please, when exposing code, try to compile it first and then do a copy-paste and in this way - a favor for us all!

Now, back to your actual problem. I see you use references, but they are only for readings. Study pointers first: http://www.cplusplus.com/doc/tutorial/pointers

[lare26]

As for what they're doing, it looks like trying to output the data held at addresses 1 - 10?

Computergeek01 is correct. I am just trying to make a simple memory scanner.

..., unless of course this is educational\experimental.

This is the the reason I am doing it. I'm just experimenting.

Study pointers first: http://www.cplusplus.com/doc/tutorial/pointers

That is the exact page I had just come from, before attempting this program.

Please, when exposing code, try to compile it first and then do a copy-paste and in this way - a favor for us all!

My code was first compiled and I cannot make heads or tails of what I did wrong. I know I am not understanding pointers very well. I also know that pointers are simple for experienced programmers so I didn't think the compiler output was necessary.

I appreciate the responses from everyone. I am still learning. I suck at book learning. Although I do attempt it first. That is why I ask on this forum.(The only forum I use for C++) I find it a lot easier to discuss, concepts which are difficult for me to understand, with the users on this forum. I assure everyone that I do "hit the books first, though.".

I submit a revamped version of the previous question: Do I have the concept right? Is just the & and * that I am mis-using?

Thanks

[userulluipeste]

When you declare a variable, a memory zone is reserved and an identifier is associated with that memory zone, like

int nNumber;

Behind the curtains, there are no identifier names, just addresses of memory, each one with an allocated fixed size. This

int &memstart = start;

is valid (if you avoid declaring "memstart" before). But here you don't allocate for "memstart" a new memory. You just assign a new identifier (the "memstart") for the existing previously-allocated memory zone which have already a memory-identifier binding with identifier "start". That ampersand unary operator is telling "declare a new identifier for that given memory zone". After the declaration, each identifier represent the same address. When you address either of them, you address just one common memory zone. After initialization, the unary ampersand operator answers, just answers the address of the identifier. It doesn't change an address of a previously-declared identifier. That is why

&memstart += 1;

won't work. If you want the dynamic functionality of addressing a different memory zone, you have to use pointers. This is what pointers do. When you declare:

int* pIntNumber;

you declare as with any other identifier declaration (except for the ones declared through reference like said above), a zone of memory and associate the "pIntNumber" identifier with it. But in this memory you write only addresses of other memory zones. These things are explained in the tutorial:
http://www.cplusplus.com/doc/tutorial/pointers/
Having a declared pointer means that you write an address at one time, then if needed, write another address, and so on. The "pIntNumber" is representing (like other identifiers) an unchangeable zone of memory that holds a changeable value representing someone else's address of memory. That is why you use pointers when needing to address different memory zones. If you'll have troubles understanding the pointers after reading the tutorial, I'll try to help you in a mode detailed manner.

[lare26]

Thank you for responding to my questions, userulluipeste. I am re-reading the pointer tutorial. I hope with your explanation, I can figure out a good memory scanner.

[Veltas]

You can't scan memory because the program is only allocated a certain range, trying to access outside that range will crash the program most likely.

If you used new to allocate memory it would contain anything that was there before it got deallocated, so you'd see the data programs were using before, but secure programs will remove it first and you may get different bits of old data overlapping.

If you want to access memory OUTSIDE your range you need OS permission, and even then the kernel and certain other parts of the memory are still out of bounds.

You'd have better luck getting a memory scanning program but it would still have the limits I mentioned to do with the kernel, but at least you wouldn't have to waste your time looking through the OS's API.

[Veltas]

If you manage to get a good scan going, I recommend reading with an unsigned char *.

Also, if you want to examine with different data types, make sure that the address you start from is evenly divisible by the type of memory's size in bytes, as this will put you in phase with where that data type is likely to be stored, due to optimisation reasons.

[Computergeek01]

@ Veltas: I think I've seen every post you've put up on this site so far and if I'm reading you right you might find these as interesting as I did:

Some Tools:
http://www.nirsoft.net/utils/dll_export_viewer.html
http://technet.microsoft.com/en-us/sysinternals/bb842062
http://www.ollydbg.de/

Some Moderate Reading:
http://www.openrce.org/articles/full_view/19

See this guys blog for some really good stuff: http://blogs.technet.com/b/markrussinovich/

Especially these recently:
Part 1: http://blogs.technet.com/b/markrussinovich/archive/2011/03/30/3416253.aspx
Part 2: http://blogs.technet.com/b/markrussinovich/archive/2011/04/20/3422035.aspx

Old But Applicable:
http://support.microsoft.com/kb/q164787/

EDIT: So you see, having the OS's "permission" can be thought of as a formality.

[Veltas]

XD, I can't hide that '10 posts' very well (would be 11 when I'm done with this one).

I'm interested to know what it is you read me as.

Thanks for the reading material, it looks quite interesting, although I must admit to being well acquainted with rundll32.exe. (I've had much malware in the past, unfortunately).

Nevertheless, when I said 'permission' I really meant that you couldn't just go ahead and touch whatever you feel like by default, especially in C++.

[lare26]

This has given me a lot to look at. I think I will read those linked posts and such as well. Thanks, everyone. :o)