https://codingvision.net/security/c-read-write-another-process-memory
Today’s tutorial is about…processes’ memory! In this article I’ll show you how to read/write a process’ memory using C#. This is a good way to learn a part of WinAPI and also understand the basics of memory allocation.
Before starting, we need a “target” - I choose notepad.exe.
1.Finding the Memory Address
As you might probably know, applications store each variable’s value at a specific memory address, we need to know that memory adress in order to edit anything. Since there’s not other way around (or I’m not aware of it?) the only solution is to start searching, using a debugger.
To get that memory address, I used OllyDbg - don’t worry, all the steps are written below.
First, open notepad.exe, type some text (like “hello world”) and attach OllyDbg (File->Attach). Press F9 and then ALT+M to open the Memory Map.
It should look like this:
Press CTRL+B and it will open the Binary Search Window. Now, because the value is stored in memory as Unicode, you have to type the string you’re looking for in the 2nd textbox:
Once you hit Ok another window will pop up - the Memory Dump. Here, look at the very first memory address (on the left) - from that address we’ll start reading. In the image below, the highlighted part contains the message I typed in Notepad.