Page 1 of 1

Monitoring a running Process' Memory space

Posted: Fri Jul 25, 2008 9:32 pm UTC
by zero10
Just wondering if you guys have any good tools to monitor the memory space of a running process? I remember back in the day there were all sorts of programs that used to let you cheat in games, you could just enter values to look for in a process' memory space and you could then manipulate them. Of course that was illegal and I'm not looking to do anything illegal with them, but I am looking for a program to do exactly that for the purposes of auditing a piece of software I have written and am looking for some good tools to use. I am already using windbg and some of the sysinternals tools but I find them pretty hard to find my way around. Do you guys have any good other suggestions?

Re: Monitoring a running Process' Memory space

Posted: Sun Jul 27, 2008 9:45 pm UTC
by Xeio
zero10 wrote:I remember back in the day there were all sorts of programs that used to let you cheat in games, you could just enter values to look for in a process' memory space and you could then manipulate them. Of course that was illegal and I'm not looking to do anything illegal with them, but I am looking for a program to do exactly that for the purposes of auditing a piece of software I have written and am looking for some good tools to use.

Its not 'illegal' to monitor and edit the memory space of a program running on your computer. Its probably not exactly nice to do something like that in an online game or such... but that will just get you a ban or some such, not arrested. :mrgreen:

Don't actually have any useful programs to do it though, sorry. :P

Re: Monitoring a running Process' Memory space

Posted: Sun Jul 27, 2008 11:39 pm UTC
by MrSparkle
I don't know of any tools, but you didn't really say what exactly you want to do so it's hard to point you at tools.

You mentioned old memory space "cheat" tools, and it is pretty easy to find those around on the web still. But it is also really easy to write those, using OpenProcess() and ReadProcessMemory() in windows.

Re: Monitoring a running Process' Memory space

Posted: Mon Jul 28, 2008 8:44 pm UTC
by zero10
I don't know for sure if its illegal to mess around with running programs, I know that for lots of them it is specifically written into the EULA that you won't do that, and I didn't want my thread getting closed or locked for legality reasons.

Its a piece of software that dumps binary files to an external device for flashing ECUs in cars. I need to see if its possible to beat the locking-feature it has by over-writing what it believes is the ECU's serial number before writing the binary file to the loader (i.e. it reads a serial from the loader, checks the serial against the file on the computer, if they match then it lets it write to the loader). There are various measures in place to prevent this, but I want to make sure they work as expected. I can't share the software for testing since you need to have the hardware as well.

Re: Monitoring a running Process' Memory space

Posted: Mon Jul 28, 2008 10:09 pm UTC
by EvanED
zero10 wrote:I don't know for sure if its illegal to mess around with running programs, I know that for lots of them it is specifically written into the EULA that you won't do that, and I didn't want my thread getting closed or locked for legality reasons.

Blizzard has had success recently with the following argument. (1) Running software requires copying it into RAM. (2) The EULA generally authorizes this copy. (3) Violating the EULA terminates this permission. (4) Using software in violation of the EULA is a violation of copyright.

Personally, I wouldn't be surprised if this were overturned if it gets appealed though, and I'm leaving it open because there are also substantial non-infringing uses.

Re: Monitoring a running Process' Memory space

Posted: Tue Jul 29, 2008 7:20 pm UTC
by zero10
True, but there is also usually a section about reverse engineering and modifying the software that this would likely violate if used on commercial software.

That said, I seem to be failing in an epic fashion at locating any of these old game trainers that I thought I remembered so well, anybody care to point a few out for me?