Gopi Krishna Komanduri wrote: > Hi Folks, > I have a query . I am learning Process Hooking. I have a doubt > about ReadProcessMemory / WriteProcessMemory . > Upto my knowledge , every process will have its own virtual memory . The two > process can have a same memory addresses . In this case , if I call > ReadProcessMemory by passing on another process and specify to read some 20 > bytes of data by passing some address , how it works internally? I mean for > an exe (unlike dlls ) the methods will be in their own memory address where > for dlls their methods will be in shared memory segment . > so please clary my doubt. Please correct me if I am wrong. > > > > GopiKrishna Komanduri > Software engineer > [EMAIL PROTECTED]
API hooking is an advanced topic, almost never works properly, almost always makes systems less stable and perform poorly (case in point: AV scanners), and is beyond the scope of this list. I recommend the folks and articles over at www.codeproject.com. My only tip to you: Detours is a pretty good place to start if you want to learn about API hooking. How the two specific APIs work that you are asking about is likely fairly involved and likely requires a system call, which would jump into kernel mode, which has full physical and virtual memory access for all processes. That seems like the likely approach for the behind-the-scenes implementation. -- Thomas Hruska CubicleSoft President Ph: 517-803-4197 *NEW* MyTaskFocus 1.1 Get on task. Stay on task. http://www.CubicleSoft.com/MyTaskFocus/
