Skip to content

MemoryCore.Query unsigned 32-bit address overflow #28

Description

@somersby10ml

Environment

Windows11 64bit os

Target process

32bit process
my process is 32bit process.

Problem

I am trying to query and read the space of 0xFF3F0000.
However, this must be accessed as unsigned.

image

public IEnumerable<RemoteRegion> Regions => from page in MemoryCore.Query(addressTo: new IntPtr(int.MaxValue), processHandle: MemorySharp.Handle, addressFrom: IntPtr.Zero)
                                            select new RemoteRegion(MemorySharp, page.BaseAddress);

int.MaxValue is 0x7FFFFFFF, but i scan address is 0xFFFF****

If you enter a larger value, an overflow error window will appear.

Exception occurred: 'System.OverflowException' (mscorlib.dll)
An unhandled exception of type 'System.OverflowException' occurred in mscorlib.dll.
An arithmetic operation caused an overflow.

I think there should be no overflow and the maximum value should be 0xFFFFFFFF or SYSTEM_INFO maximumApplicationAddress (GetSystemInfo) and there should be no overflow.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions