Dave Cartright wrote:
I am trying to read the memory of another process with ReadProcessmemory and I can only get it to work when I commit the entire region I want to read with VirtualAllocEx - but as you probably know when I do this it initializes the entire memory region to 0s. So my question is how do I get ReadProcessmemory to read from the region??
It sounds to me like you're trying to read the previous contents of areas of memory. However, you don't seem to realise either that virtual memory is not physical memory or that uncommitted virtual memory is not backed by a page of memory in swap or physical memory, so calling ReadProcessMemory on it doesn't make sense as there is no data there to be read! Furthermore, when a page of virtual memory is deallocated then it free to be allocated again by any process in the system, and as you say it is initialised to all 0's as a security measure and you can't get that same page back again.
-
Robert Shearman