Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I was Googling for a while now, and I don't seem to find what I am looking for.

Imagine I have a programm running (for example some random image generator, perhaps captcha) and I have a background process with NO GUI but with Full permission running on the same machine. I want the second process to capture the location of the Image object (assuming I know the object type and maybe even approximate size) and get its contents into a local process variable. Is it possible to do? I know the reading RAM part is possible (Cheat Engine does that easily), but actuall task of detecting an object of certain type which is located in a certain process's memory. Will knowing the variable name help me? Is there a list with addresses of all variables in memory somewhere?

share|improve this question

closed as off topic by Gilles, TildalWave, Adnan, AJ Henderson, Antony Vennard May 14 '13 at 11:13

Questions on Information Security Stack Exchange are expected to relate to Information security within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here.If this question can be reworded to fit the rules in the help center, please edit the question.

4  
Under what operating system? From a security perspective, the answer is generally yes as long as the other program has sufficient privileges. But practically speaking, looking for the image in memory is very unlikely to be the simplest way of solving your problem. The easiest way would be to make the image generator dump the image into a file. If you really can't do that, you can arrange to grab it from the display, whether or not your capture program itself has a GUI. I suggest asking on Stack Overflow, stating your end goal (with the OS, program, etc.) and not the wrong path you've started on. –  Gilles May 12 '13 at 21:08
    
@Gilles Thanks. I was thinking of the issue from the security side of view, as the task I am trying to acomplish is tricker than extracting an image from the Third-party program. I am trying to understand if system (any in general, Windows in specific) keeps a list of variables (index) somewhere in the memory and if it (segment of memory with index) is readable to the process. I will try asking on Stack Overflow from programming side of view as well. –  Xeos May 12 '13 at 21:59
    
There is no "list with address of variables in memory". Some programs, depending on their programming language, may have a list of some kind, but it generally isn't connected with variable names that, in compiled languages, usually don't even exist anyway. You can recognize the image from its format, though, if you know what you're looking for and its storage layout in the target program. –  lserni May 12 '13 at 23:14

1 Answer 1

up vote 1 down vote accepted

I am just a developer with a security interest, but:

It seems like one way to answer your question is the technique of File / Memory Carving.

Looking through the raw memory or disk for content (such as images or documents etc).

It is a forensics technique, sort of like brute force searching memory for documents.

File Carving - Includes a lot of related terminology

File Carving Tools (start with a memory image)

share|improve this answer
    
Thanks. Will check those out. –  Xeos May 13 '13 at 23:24

Not the answer you're looking for? Browse other questions tagged or ask your own question.