ReadProcessMemory returns nothing

evolution445 · August 31st, 2008, 04:11 AM

Hi,

I have a function that gathers info through readprocessmemory, converts it to ASCII and puts it in a textbox, atleast, that's what I want it to do, but it returns nothing and results in an error.

Code:

Unable to cast object of type 'System.Byte' to type 'System.Byte[]'.

Part of the code:

Code:

        Dim hwnd, idprocess, hprocess As Integer
        Dim mapnamebyte As Object
        hwnd = FindWindow(vbNullString, appname)
        If hwnd < 0 Or hwnd > 0 Then
            GetWindowThreadProcessId(hwnd, idprocess)
            hprocess = OpenProcess(PROCESS_VM_READ, False, idprocess)
            ReadProcessMemory(hprocess, address, mapnamebyte, 16, vbNullString)
            Dim string = System.Text.Encoding.UTF8.GetString(mapnamebyte, vbNullString, 16)
            txt_mapname.Text = string
            CloseHandle(hwnd)
        Else
            txt_mapname.Text = "Could not get mapname"
        End If

I've tried to Dim mapnamebyte as Byte, Object or nothing, but it just doesnt return anything in the textbox.
What am I doing wrong ?

Thanks in advance,
evolution445

evolution445 · September 2nd, 2008, 06:44 AM

Anyone has an idea of what I'm doing wrong ?

BrianWren · September 2nd, 2008, 12:29 PM

Apparently you have dimmed mapnamebyte (which, if it were me, I would naem MapNameByte for readability) as a byte, but whichever line you are getting the error on is trying to treat it as an array of bytes.

Try Dim MapNameByte() As Byte, using parens to establish it as an array.

Or repost, specifying which line is throwing this error.

evolution445 · September 3rd, 2008, 08:00 AM

I've changed it to "MapNameByte()", and now this is my error:

Value of type '1-dimensional array of Byte' cannot be converted to 'Byte'.

The error is cast on this line at the moment:

Code:

ReadProcessMemory(hprocess, &H6B4E25, MapNameByte(), 16, vbNullString)

Also, do I have to do something with "lpNumberOfBytesWritten", which I currently set to "vbNullString" ?

BrianWren · September 3rd, 2008, 02:43 PM

I didn't say to add parens to the Function call, but to the Dim statement. So try:

Code:

    ...

    Dim MapNameByte() As Byte

    ...

    ReadProcessMemory(hprocess, &H6B4E25, MapNameByte, 16, vbNullString)

evolution445 · September 3rd, 2008, 02:54 PM

It still gives the error, without the parents inside the function.

I do remember, before I didn't had this error. Instead, there was a different error on the convert line. It wouldn't want to convert the bytes to ASCII. I then mixed up the variables a little, and now I'm stuck..

evolution445 · September 5th, 2008, 08:48 AM

Anyone ?

evolution445 · September 12th, 2008, 08:23 AM

I was hoping to have finished my program a few weeks ago. It appears no-one everywhere has the knowledge of how 'Readprocessmemory' works ?

BrianWren · September 12th, 2008, 01:52 PM

MapNameByte is the area to which the results of the function will be written. So, noturally, there needs to be a suitably sized area set asside to receive those data.

So, I would:

Code:

    Dim hWnd As Integer = FindWindow(vbNullString, AppName)
    Dim idProc, hProc   As Integer
    Dim MapNameByte(16) As Byte

    If hwnd <> 0 Then

        GetWindowThreadProcessId(hWnd, idProc)
        hProc = OpenProcess(PROCESS_VM_READ, False, idProc)
        ReadProcessMemory(hProc, addr, MapNameByte, 16, vbNullString)
        ' Donât use a VB Type as a Var Name.
        ' And where is the declaration of the type? â... As ...â
        Dim sString = System.Text.Encoding.UTF8.GetString(MapNameByte, _
                                                          vbNullString, 16) 
        txt_MapName.Text = sString
        CloseHandle(hWnd)

    Else

        txt_mapname.Text = "Could not get MapName"

    End If

I am not familiar with the GetString() function, so Iâll just presume you have it right. After all, your question is on a different topic...

What Iâve done (aside from making the var names shorter, and easier to read) is set aside 17 bytes as an array (or 16; I forget how the initializing argument works...). The name of that array is actually a pointer to the memory, when used in an API fuction.

evolution445 · September 12th, 2008, 02:20 PM

The declaration of the type ? You mean 'vbNullString' ? As far as I know it stands for 'nothing'. I did that cause I didnt have a clue what to do with 'lpNumberOfBytesWritten'. Is that the function that you have to 'set aside' so it can receive the info ?