|
-
Sep 9th, 2007, 09:43 AM
#1
Thread Starter
New Member
Defeating DMA
Hi.
I need to read a value from memory (it's DMA) for analysis, but I only need to "read" this value and not change it (NOP won't solve my problem).
I tried code injection to store away the DMA address to a static location in the code section of the exe but i get a access violation error when i try to mov it.
Although i can write to the same address using writeprocessmemory (or cheat engine,artmoney etc.) but I cannot write to it from my code cave.
Is this because the memory page only have read access? (altough writeprocessmemory works)
This is the mov i'm using:
(i'm moving the mem addy into eax before this call)
MOV DWORD PTR DS:[44FFFE],EAX
this causes the access violation, this as well:
MOV BYTE PTR DS:[44FFFE],5
BUT this works:
MOV DWORD PTR DS:[450000],EAX
or
MOV BYTE PTR DS:[450000],5
but it is outside the code location (according to ollydbg)
Altough this works maby i'll overwrite some information that is required 
Any ideas?
Posting Permissions
- You may not post new threads
- You may not post replies
- You may not post attachments
- You may not edit your posts
-
Forum Rules
|
Click Here to Expand Forum to Full Width
|