Function ReadProcessMemory keeps returning ERROR_PARTIAL_COPY

Question

I know that there are other people that have asked this question but it seems as though none of them reached a satisfying or understandable conclusion. I can't use what isn't answered. I am not quite sure what the problem is and I have tried various different solutions with no success so here is my code:

#include <windows.h>
#include <iostream>
using namespace std;

int main()
{
    HANDLE hProc = OpenProcess(PROCESS_ALL_ACCESS | PROCESS_QUERY_INFORMATION, FALSE, (DWORD)7312);

    if(hProc == NULL)
    {
        cout << "Error: " << GetLastError() << endl;
    }

    HANDLE token;

    OpenProcessToken(hProc, TOKEN_ALL_ACCESS, &token);

    void *baseAddr = VirtualAllocEx(hProc, NULL, 500, MEM_RESERVE, PAGE_EXECUTE_READWRITE);

    if(baseAddr == NULL)
    {
        cout << "VirtualAllocEx has failed" << endl;
    }
    else
    {
        cout << "Base Address: " << baseAddr << "\n" << endl;
    }

    DWORD prevProt;

    if(VirtualProtectEx(hProc, &baseAddr, sizeof(DWORD), PAGE_EXECUTE_READWRITE, &prevProt) == 0)
    {
        if(GetLastError() == 87)
        {
            cout << "ERROR_INVALID_PARAMETER\n" << endl;
        }
        else if(GetLastError() == 487)
        {
            cout << "ERROR_INVALID_ADDRESS\n" << endl;
        }
    }

    void *buffer;

    if(ReadProcessMemory(hProc, baseAddr, &buffer, sizeof(SIZE_T), NULL) == 0)
    {
        if(GetLastError() == 299)
        {
            cout << "ERROR_PARTIAL_COPY" << endl;
        }
    }
}

Any contribution and knowledge you can offer is deeply appreciated! :)

Bare with me here because I really don't know much about how memory works, but I don't know the difference. — David Leon
– David Leon, Commented Jan 7, 2016 at 6:22
@DavidLeon: what exactly are you trying to accomplish with this code in the first place? — Remy Lebeau
– Remy Lebeau, Commented Jan 7, 2016 at 6:23
I was curious about how decompilation works and such so I'm testing this out on some screen capturing software I made. — David Leon
– David Leon, Commented Jan 7, 2016 at 6:38
To simply read another process's compiled code, you don't need to use VirtualAllocEx() and VirtualProtectEx() at all. Simply allocate a local buffer big enough to receive the code, and then ReadProcessMemory() into that buffer. Code can be large, so you will likely have to read it in chunks. As for the base address of the code, you will have to read and parse the remote process's PE header to discover where the code is located in memory. Then you can disassemble it manually as needed. — Remy Lebeau
– Remy Lebeau, Commented Jan 7, 2016 at 19:42

Community · Accepted Answer · 2017-05-23 12:16:18Z

I see some issues with your code.

Bad error handling. If an error happens, you log it, but keep going forward with bad data. If an error happens, STOP. And you are misusing GetLastError().
You are passing the wrong base addess to VirtualProtectEx(). &baseAddr neds to be baseAddr instead. Also, you are allocating and protecting the memory with EXECUTE permissions, which you should not be using unless you intend to store executable code in the memory (which this code is not doing).
You are using sizeof(DWORD) to set protection flags on the remote memory, but you are using sizeof(SIZE_T) to read the memory. DWORD is a fixed 32 bits in size, but SIZE_T is 32 or 64 bits, depending on the platform you are compiling for. Change SIZE_T to DWORD to match the rest of your code.
You are not allocating any memory in the calling process for ReadProcessMemory() to write to. Change void *buffer; to DWORD buffer;.

Try this:

#include <windows.h>
#include <iostream>
using namespace std;

int main()
{
    DWORD dwError;

    HANDLE hProc = OpenProcess(PROCESS_ALL_ACCESS | PROCESS_QUERY_INFORMATION, FALSE, (DWORD)7312);
    if (hProc == NULL)
    {
        dwError = GetLastError();
        cout << "OpenProcess has failed. Error: " << dwError << endl;
        return 0;
    }

    HANDLE token;
    if (!OpenProcessToken(hProc, TOKEN_ALL_ACCESS, &token))
    {
        dwError = GetLastError();
        cout << "OpenProcessToken has failed. Error: " << dwError << endl;
        return 0;
    }

    void *baseAddr = VirtualAllocEx(hProc, NULL, 500, MEM_RESERVE, PAGE_READWRITE);
    if (baseAddr == NULL)
    {
        dwError = GetLastError();
        cout << "VirtualAllocEx has failed. Error: " << dwError << endl;
        return 0;
    }

    cout << "Base Address: " << baseAddr << endl;

    DWORD prevProt;
    if (!VirtualProtectEx(hProc, baseAddr, sizeof(DWORD), PAGE_READWRITE, &prevProt))
    {
        dwError = GetLastError();
        cout << "VirtualAllocEx has failed. Error: ";
        if (dwError == ERROR_INVALID_PARAMETER)
        {
            cout << "ERROR_INVALID_PARAMETER";
        }
        else if (dwError == ERROR_INVALID_ADDRESS)
        {
            cout << "ERROR_INVALID_ADDRESS";
        }
        else
        {
            cout << dwError;
        }
        cout << endl;
        return 0;
    }

    DWORD buffer;
    if (ReadProcessMemory(hProc, baseAddr, &buffer, sizeof(DWORD), NULL))
    {
        dwError = GetLastError();
        cout << "ReadProcessMemory has failed. Error: ";
        if (dwError == ERROR_PARTIAL_COPY)
        {
            cout << "ERROR_PARTIAL_COPY";
        }
        else
        {
            cout << dwError;
        }
        cout << endl;
        return 0;
    }

    cout << "Value: " << buffer << endl;
    return 0;
}

Some more issues:

You are reserving memory in the remote process, but you are not committing physical storage for that memory, and you are not writing anything into the memory before reading from it. Reading reserved uncommitted memory is not very useful, and is the likely culprit of your error:

https://stackoverflow.com/a/4457745/65863

ReadProcessMemory would return FALSE and GetLastError would return ERROR_PARTIAL_COPY when the copy hits a page fault.

Working Set

When a process references pageable memory that is not currently in its working set, a page fault occurs.
You are not using the token returned by OpenProcessToken(), so that call is useless.
You are protecting the remote memory with VirtualProtectEx() using the same protection flags you specified when allocating the memory. So this call is useless, too.

I did all the stuff you said and it still says ERROR_PARTIAL_COPY.
stackoverflow.com/a/4457745/65863: "ReadProcessMemory would return FALSE and GetLastError would return ERROR_PARTIAL_COPY when the copy hits a page fault."

Ajay · Accepted Answer · 2016-01-07 05:48:27Z

1

The expression &buffer is wrong - ReadProcessMemory won't allocate buffer for you, it will write on the buffer you provide. You need to allocate memory, and pass that buffer to ReadProcessMemory. Possible approach:

void *buffer = new BYTE[512];
ReadProcessMemory(hProc, baseAddr, buffer, sizeof(SIZE_T), NULL);

answered Jan 7, 2016 at 5:48

Ajay

18.6k14 gold badges65 silver badges111 bronze badges

1 Comment

David Leon Over a year ago

Still returning ERROR_PARTIAL_COPY but thank you for correcting me.

Collectives™ on Stack Overflow

Function ReadProcessMemory keeps returning ERROR_PARTIAL_COPY

2 Answers 2

2 Comments

1 Comment

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

2 Comments

1 Comment

Your Answer

Sign up or log in

Post as a guest

Linked

Related