911 WHY: ReadProcessMemory failed with ERROR_PARTIAL_COPY 
Author Message
 911 WHY: ReadProcessMemory failed with ERROR_PARTIAL_COPY

trying to read another process' memory but got ERROR_PARTIAL_COPY error.
please help.

    char szFilename[] = "C:\\Documents and
Settings\\Administrator\\Desktop\\imghlptst\\exe.exe";
    DWORD image_base;
    DWORD image_size;

    LOADED_IMAGE li;

    MapAndLoad( szFilename, 0, &li, FALSE, TRUE);
    image_base = li.FileHeader->OptionalHeader.ImageBase;
    image_size = li.SizeOfImage;
    UnMapAndLoad( &li );

    BOOL b;
    DWORD err;

    STARTUPINFO si1;
    PROCESS_INFORMATION pi1;
    HANDLE hp1;

    memset(&si1,0,sizeof(STARTUPINFO));
    si1.cb = sizeof(STARTUPINFO);
    b=CreateProcess(szFilename,0,0,0,0,CREATE_SUSPENDED,0,0,&si1,&pi1);
    if (!b)
        err = GetLastError();

    hp1 = pi1.hProcess;

    DWORD dwRead = 0;
    void * buf = malloc(image_size);

    b=ReadProcessMemory(hp1,(LPCVOID)image_base,buf,image_size,&dwRead);
    if (!b)
        err = GetLastError();

b = FALSE (failed)
dwRead = 0xffc00000
err = ERROR_PARTIAL_COPY (0x12b) (Only part of a ReadProcessMemory or
WriteProcessMemory request was completed.)



Tue, 30 Sep 2003 23:36:01 GMT  
 911 WHY: ReadProcessMemory failed with ERROR_PARTIAL_COPY
Couple of suggestions:

Are you logged as an Admin ? Or try to use CreateProcessAsUser . I suspect
about the process you are spawning.  If the memory of the process in
question is not  read only, we will end up in issues too.

From MSDN:

Return Values
If the function succeeds, the return value is nonzero.

If the function fails, the return value is zero. To get extended error
information, call GetLastError.

The function fails if the requested read operation crosses into an area of
the process that is inaccessible.

Remarks
ReadProcessMemory copies the data in the specified address range from the
address space of the specified process into the specified buffer of the
current process. Any process that has a handle with PROCESS_VM_READ access
can call the function. The process whose address space is read is
typically, but not necessarily, being debugged.

The entire area to be read must be accessible. If it is not, the function
fails as noted previously.



Sun, 25 Jan 2004 03:15:17 GMT  
 911 WHY: ReadProcessMemory failed with ERROR_PARTIAL_COPY
status update


Sun, 25 Jan 2004 05:57:54 GMT  
 
 [ 3 post ] 

 Relevant Pages 

1. Help with coding needed!!!! S.O.S 911 S.O.S. 911

2. VC++ wizards/templates 911

3. MCNY Express - Your Emergency 911# For Web Development And Technical Needs

4. VC++ Wizards Templates 911

5. VC++ wizards templates 911

6. Help, 911

7. 911: DLL needs the caller

8. 911: CList compile error

9. 911- help reading string from text file

10. 911 with MAP erase()

11. ReadProcessMemory() and WriteProcessMemory() syntax

12. ReadProcessMemory, how to converting return value ?

 

 
Powered by phpBB® Forum Software