Баг с чтением из внтуренней памяти процесса.

[Ivan_32]

Просто лезу на потолок от этого кода, непонимаю в чем проблема.

586
.model flat,stdcall
option casemap:none

   include windows.inc
   include user32.inc
   include kernel32.inc
   include masm32.inc
   includelib masm32.lib
   includelib user32.lib
   includelib kernel32.lib


WinMain proto :DWORD,:DWORD,:DWORD,:DWORD
dwtoa proto :DWORD,:DWORD

.data
dvM dw"00","01","02","03","04","05","06","07","08","09","0A","0B","0C","0D","0E","0F"
	dw"10","11","12","13","14","15","16","17","18","19","1A","1B","1C","1D","1E","1F"
	dw"20","21","22","23","24","25","26","27","28","29","2A","2B","2C","2D","2E","2F"
	dw"30","31","32","33","34","35","36","37","38","39","3A","3B","3C","3D","3E","3F"
	dw"40","41","42","43","44","45","46","47","48","49","4A","4B","4C","4D","4E","4F"
	dw"50","51","52","53","54","55","56","57","58","59","5A","5B","5C","5D","5E","5F"
	dw"60","61","62","63","64","65","66","67","68","69","6A","6B","6C","6D","6E","6F"
	dw"70","71","72","73","74","75","76","77","78","79","7A","7B","7C","7D","7E","7F"
	dw"80","81","82","83","84","85","86","87","88","89","8A","8B","8C","8D","8E","8F"
	dw"90","91","92","93","94","95","96","97","98","99","9A","9B","9C","9D","9E","9F"
	dw"A0","A1","A2","A3","A4","A5","A6","A7","A8","A9","AA","AB","AC","AD","AE","AF"
	dw"B0","B1","B2","B3","B4","B5","B6","B7","B8","B9","BA","BB","BC","BD","BE","BF"
	dw"C0","C1","C2","C3","C4","C5","C6","C7","C8","C9","CA","CB","CC","CD","CE","CF"
	dw"D0","D1","D2","D3","D4","D5","D6","D7","D8","D9","DA","DB","DC","DD","DE","DF"
	dw"E0","E1","E2","E3","E4","E5","E6","E7","E8","E9","EA","EB","EC","ED","EE","EF"
	dw"F0","F1","F2","F3","F4","F5","F6","F7","F8","F9","FA","FB","FC","FD","FE","FF"
   fName db "G:\file.bin"
   mBuff db 2000h dup(0)
   val db 0F7h
   ClassName db "MainWinClass",0
   AppName  db "Main Window",0
   buff db 20 dup(0)
   dv0 db "0123456789ABCDEF",0
.data?
   hFile HANDLE ?
   ofs OFSTRUCT <>
   hInstance HINSTANCE ?
   CommandLine LPSTR ?
   gMem HANDLE ?
   gAddrMem HANDLE ?
   hProcess HANDLE ?
   mbi MEMORY_BASIC_INFORMATION <>
.code


; ---------------------------------------------------------------------------


start:
	invoke GetModuleHandle, NULL
	mov    hInstance,eax
	
	invoke GetCommandLine
	mov    CommandLine,eax
	
	invoke WinMain, hInstance,NULL,CommandLine, SW_SHOWDEFAULT
	invoke ExitProcess,eax

WinMain proc hInst:HINSTANCE,hPrevInst:HINSTANCE,CmdLine:LPSTR,CmdShow:DWORD
	invoke GlobalAlloc,GMEM_ZEROINIT or GMEM_MOVEABLE,10000h
	mov gMem,eax
	invoke GlobalLock,gMem
	mov gAddrMem,eax
	invoke OpenProcess,PROCESS_ALL_ACCESS,FALSE,5300
	mov hProcess,eax
	xor eax,eax
	pushad
	invoke VirtualQueryEx,hProcess,10000h,addr mbi,SIZEOF mbi 
	invoke ReadProcessMemory,hProcess,10000h,gAddrMem,10000h,ecx 
	popad
	pushad
	xor ecx,ecx
	.WHILE ecx<10000h
		pushad
		mov ebx,gAddrMem
		mov al,byte ptr [ebx+ecx]
		mov ah,byte ptr val
		.IF al==[val]
			mov edx,mbi.BaseAddress
			add edx,ecx
			invoke dwtoa,edx,addr buff
			invoke MessageBox,0,addr buff,0,0
		.endif
		popad
		inc ecx
	.ENDW
	popad
	pushad
	xor eax,eax
	mov al,byte ptr [gAddrMem+0]
	invoke dwtoa,eax,addr mBuff
	invoke MessageBox,0,addr mBuff,0,0; Вот этот меседж бокс выдает 232 
	popad
	.IF gAddrMem!=NULL
		invoke MessageBox,0,gAddrMem,0,0
	.endif
	ret
WinMain endp
end start

Известно что по адресу 00010000 в целевом процессе стоит байт 6Ah при этом меседж бокс выдает что то левое...в случае с 6Ah это 232
Кстати сама считываемая память корректная - в gAddrMem хранится именно то что нужно. Вот считать не получается...

[Д'якон]

Ну во-первых память процесса вроде начинаеться с 00400000, ну да ладно, допустим считал. Во-вторых МесагеБокс использует указатель на строку. Поэтому, допустим что месаге бокс сработал, то он покажет текст по адресу6Аh. Ну и третье, даже если будешь использовать addr или offset то месагебокс выдаст символ. Для начала нужно значение перевести в string, а потом уже при помощи offset выводить в месагебокс

[rpy3uH]

invoke ReadProcessMemory,hProcess,10000h,g AddrMem,10000h,ecx
во-первых, точно ли в ecx находится ноль.
во-вторых, не производится ни одна проверка на успешность вызовов функций OpenProcess, VirtualQueryEx, eadProcessMemory

[Ivan_32]

Последний MessageBox выдает именно те символы которые в памяти находятся. Проблема не в чтени из процесса и даже не из gAddrMem. Точнее наверно как раз в посленем, но в способе. Я немогу понять почему там лежит именно то что нужно но я немогу корректно считать это оттуда.