Searching process memory for value

Jun 15, 2010 at 10:04pm
Hello,
I am trying to make a small utilty that will search a process's memory for a specified value. I am currently able to both read and write memory values. But I'm not sure how I would go about scaning the memory for a value and getting it's base address.
The program can read arbitrary memory locations with specified lengths. But how do I know where (What memory location) to start searching from and where to stop searching. I believe it has something to do with using the mapped memory files but not sure.
Could someone please enlighten me on how to do this or point me towards a resource which will help me figure this out?

Thanks!
Last edited on Jun 15, 2010 at 10:39pm
Jun 16, 2010 at 4:13am
Will the utility be used to search its own process space, or is the goal to search another process's address space?
Jun 16, 2010 at 1:59pm
It will be used to access another process's address space
Jun 16, 2010 at 8:37pm
You probably want to have a look at how a debugger such as gdb gets access to another process space. You will have to use similar hooks I think.
Topic archived. No new replies allowed.