I was trying to use
using the stack-based method. However it wasn't working. What I do is migrate to the actual process I am trying to read memory from, then drop to irb and execute the commands:
proc = client.sys.process.open(session.sys.process.getpid, PROCESS_ALL_ACCESS) tid = proc.thread.each_thread.first thread = proc.thread.open(tid) esp = thread.query_regs['esp']
When I do that, esp is set to 0, which doesn't seem right. Also, alot of the other registers are set to 0, including eip. From processhacker I can see the eip and it's definetly not 0.
Would someone be able to help me out to figure out what I'm doing wrong? I am running this on Win7 x64 box.
Also, if I go into processhacker and figure out the memorylocation, I can read the data using proc.memory.read, I just want to be able to do that dynamically.