Calling OpenProcess / ReadProcessMemory from injected DLL

[matt69]

Ok, so I have a strange problem and am totally confused as to what is happening.

I am hooking Conquer and getting decrypted packets. Where I hook the function I get a pointer to a memory address where I need to read the decrypted packet from along with the length.

The problem is that for some reason when I first hook the Conquer, I always get an ERROR_INVALID_HANDLE (0x06) error code when I try OpenProcess or ReadProcessMemory from the injected DLL.

The even weirder part is that after about 1-2 minutes, it starts to work fine with no more errors! (i.e. for 1-2 minutes all the OpenProcess / ReadProcessMemory attempts will return an error and zeroes and then for some reason after 1-2 minutes it starts to work fine with no issues at all)


Does anyone have any idea what might be happening here?

Edit: Nevermind, I have solved it by simply using Marshal.Copy rather than using OpenProcess/ReadProcessMemory

[Best Coder 2014]

Originally Posted by matt69

Edit: Nevermind, I have solved it by simply using Marshal.Copy rather than using OpenProcess/ReadProcessMemory

^ Yeah, the DLL you injected already has access to the entire process that it's injected into, so there's no need for OpenProcess.

What you could do, if you really want to use the Read/WriteProcessMemory functions from inside the DLL is to use the function to obtain a handle for the current process that can be passed to the Read/WriteProcessMemory functions.