Readmemory

ulong Readmemory(void *buf,ulong addr,ulong size,int mode);

Reads memory of the debugged process. As this operation is time-consuming, the memory is cached.

To assure memory consistency in a read-modify-write sequence, put this sequence inside the pair Suspendallthreads() / Resumeallthreads().


Parameters:

buf
(in) Buffer that receives copy of memory, at least size bytes long
addr
(in) Start address of the memory block in the context of debugged process
size
(in) Requested memory size, bytes
mode
(in) Memory reading options, a combination of the following flags:
MM_REPORT - display error message if memory is not readable (default). Can't be combined with MM_SILENT
MM_SILENT - don't display error message if memory is not readable. Can't be combined with MM_REPORT
MM_NORESTORE - don't replace INT3 breakpoints set by OllyDbg by original values. Default action is to restore breakpoints
MM_PARTIAL - allow reading less than size bytes. Default action is to fail if the requested memory is not completely readable
MM_FAILGUARD - requests to fail if memory is guarded or read-protected. Default action is to change for a short moment the memory attributes of the specified block and retry reading


Return values:
Size of the read memory in bytes, or 0 on error. Note that if flag MM_PARTIAL is set, returned size may be smaller than requested


See also:
t_memory, Editmemory(), Findmemory(), Flushmemorycache(), Listmemory(), Readmemoryex(), Resumeallthreads(), Suspendallthreads(), Writememory()