| BOOL WriteProcessMemory(hProcess, lpBaseAddress, lpBuffer, cbWrite, lpNumberOfBytesWritten) | |||||
| HANDLE hProcess; | /* proc whose memory is written | */ | |||
| LPVOID lpBaseAddress; | /* addr to start writing | */ | |||
| LPVOID lpBuffer; | /* buffer to write to addr space | */ | |||
| DWORD cbWrite; | /* no. of bytes to write | */ | |||
| LPDWORD lpNumberOfBytesWritten; | /* actual no. of bytes written | */ | |||
The WriteProcessMemory function writes memory within a specified process.
hProcess
Specifies an open handle to a process whose memory is to be written. The handle must have been created with PROCESS_VM_WRITE access to the process.
lpBaseAddress
Specifies the base address in the specified process to be written. Before any data transfer occurs, the system verifies that all data within the base address and the specified size is accessible for write access. If this is the case, the function proceeds. Otherwise, the function fails.
lpBuffer
Specifies the address of a buffer which supplies the data to be written into the specified process address space.
cbWrite
Specifies the requested number of bytes to write into the specified process.
lpNumberOfBytesWritten
An optional parameter, that if supplied receives the actual number of bytes transferred into the specified process. This can be different than the value of cbWrite if the requested write crosses into an area of the process that is inaccessible (and that was made inaccessible during the data transfer). If this occurs, the function returns FALSE and GetLastError returns a “short write” error indicator.
The return value is TRUE if the function was successful, or FALSE if an error occurred. Use the GetLastError function to obtain extended error information.
This function copies the data from the specified buffer in the current process to the address range of the specified process. Any process that has a handle with PROCESS_VM_WRITE access to the process to be written can call WriteProcessMemory. The process whose address space is being written does not have to be being debugged.
ReadProcessMemory