C++ Reading memory from a string

Question

I was trying to read a memory from explorer.exe. With a program process hacker I found that on the address 0xfa07f8 this string is stored: \??\C:\Program Files\Process Hacker 2\ProcessHacker.exe

When I try to read the string of this address, I get only the first character of the string back. The '\' char. How can I read the whole string?

char buffer[255] = { 0 };
unsigned addr = 0xfa07f8;
if (ReadProcessMemory(proc, (LPVOID)addr, &buffer, sizeof(buffer), NULL))
{
    MessageBoxA(NULL, buffer, NULL, NULL);
}

The string will be in Unicode UTF-16 and every other byte will be 0 for the ASCII characters. — Richard Critten
– Richard Critten, Commented Jun 30, 2021 at 20:57
What do you see when you inspect the contents of buffer with your debugger? — Captain Giraffe
– Captain Giraffe, Commented Jun 30, 2021 at 20:58
You probably read a bstr_t value from that address, the `\??\` represent the prefixed string length, that you see printable characters there is just by chance. — πάντα ῥεῖ
– πάντα ῥεῖ, Commented Jun 30, 2021 at 21:01
@TedLyngmo yes it worked. just replaced the MessageBoxA function with MessageBoxA — JeduMiSePalacinke
– JeduMiSePalacinke, Commented Jun 30, 2021 at 21:21

jkb · Accepted Answer · 2021-06-30 21:21:43Z

2

You are reading wide characters from the process memory. MessageBoxA is for displaying "narrow" characters.

To display wide characters, use MessageBoxW.

answered Jun 30, 2021 at 21:21

jkb

2,4701 gold badge12 silver badges15 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

C++ Reading memory from a string

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related