Question How to read a value from the memory with a dll pointer?


New member
Jan 13, 2016
Programming Experience
First of all I want to say sorry because I don't know at all what I need to do what I'm looking for and maybe I'll post something nosense.

Well, what I'm looking for is just to read a value stored into the memory of a program. The point is that this program use a DLL thats seems to have a pointer (I think) to this value but I don't know how I can use it, I spent many days searching over the internet and I think that I should hook the DLL to have access to such code but I'm not sure about this, by the way I found the code for the same program that do exactly what I need but is on C++ and I need it on C# and I'm unable to "convert" it.

Here are some parts of the code I found, lets see if someone can guide me over the question:

User_fn8 ptrUser::ptrFun8 = NULL;
static HINSTANCE ptrUser_h_Instance;

void User::Hook() //BEGIN HOOK
   ptrUser_h_Instance = GetModuleHandle(TEXT("engine.dll"));

   MAKE_POINTER(ptrUser_h_Instance, ptrUser::ptrFun8, User_fn8, "?GetNickName@User@@QAEPAGXZ");
   HOOK_FUNC(ptrUser_h_Instance, "?GetNickName@User@@QAEPAGXZ", &User::OnCalled_GetNickName, ptrUser::ptrFun8);

void User::UnHook() //BEGIN UNHOOK
   UNHOOK_FUNC(ptrUser_h_Instance, "?GetNickName@User@@QAEPAGXZ", &User::OnCalled_GetNickName, ptrUser::ptrFun8);

unsigned short * User::OnCalled_GetNickName(void) //BEGIN EVENT: unsigned short * User::GetNickName(void)
   //Put your code here
   unsigned short * retval = NULL;
   if ( TITLE->GetTitle ( this, retval ) )
      return retval;
   return GetNickName();
} //END EVENT: unsigned short * User::GetNickName(void)

And my try:
using System;
using System.Diagnostics;
using System.Runtime.InteropServices;
using System.Text;
using System.Threading;

public class win32
    [DllImport("kernel32.dll", CharSet = CharSet.Ansi, SetLastError = true)]
    public static extern IntPtr LoadLibrary(string dllToLoad);

    [DllImport("kernel32.dll", CharSet = CharSet.Ansi, SetLastError = true)]
    public static extern IntPtr GetProcAddress(IntPtr hModule, string procedureName);

    [DllImport("kernel32.dll", CharSet = CharSet.Ansi, SetLastError = true)]
    public static extern bool FreeLibrary(IntPtr hModule);

    public delegate short GetNickName();

    public static void Main()
        IntPtr pDll = win32.LoadLibrary(@".\\Engine.dll");
        IntPtr pAddressOfFunctionToCall = win32.GetProcAddress(pDll, "?GetNickName@User@@QAEPAGXZ");

        GetNickName getNickName = (GetNickName)Marshal.GetDelegateForFunctionPointer(pAddressOfFunctionToCall, typeof(GetNickName));

        short theResult = getNickName();
        bool result = win32.FreeLibrary(pDll);

But I get this error "Unhandled Exception: System.AccessViolationException: Attempted to read or write protected memory. This is often an indication that other memory is corrupt" at getNickName();

What I'm doing wrong?
I don't know if this will fix your error, but it's worth taking a gander
Dynamic Invoke C++ DLL function in C# - CodeProject

But c# doesn't suport C++ function pointer, so we cannot invoke a C++ function pointer here. C# only has Delegate objects and we have to convert the function pointer to Delegate by Marshal.GetDelegateForFunctionPointer. It is declared in System.Runtime.InteropServices

also, there are a bunch of tutorials on memory editing in c++/c# you should check out here:

Im still a beginner at c# but ive done a little memory editing in c++ and the tutorials above are the best I could find.
Hope this helps :)
Top Bottom