title: How to get all memory address space used by a process?
body: <p>I need to know all memory address space used by a process. The memory space will later be scanned to locate values within the process and identify their locations / addresses. My current process for this is to take each module's base address through its (base address + memory size).</p>
  
  <p>I'm testing this on a process with a known value at a known address. When I look up that specific address, I get the value I expect. However, when I scan (what I believe to be) all address space used by the process, I can't find the value anywhere.</p>
  
  <p>I know that a numeric value "4143000" exists at <em>0x0CF8DC38</em> and <em>0x0CF8DDDC</em>. When I call <em>ReadMemoryBytes(module, module.BaseAddress, 4, (IntPtr)(0x0CF8DC38))</em> I get back bytes (152, 55, 63, 0). When I call BitConverter.GetBytes(4143000) I get back the same set of bytes. When I use a different memory scanner on that process, I find that value at those addresses.</p>
  
  <p>However, when I scan the "known addresses", I don't find this value anywhere. It doesn't look like my code is even finding those addresses in use by the process.  </p>
  
  <p>Thusly, my question is twofold:</p>
  
  <ul>
  <li>How can I find these addresses within this process?</li>
  <li>I'm concerned I may be dealing with absolute addresses in system memory versus relative addresses within a process. Am I doing this right?</li>
  </ul>
  
  <p>.</p>
  
  <pre><code>// (in the calling method)
  foreach (ProcessModule module in process.Modules) {
      ParameterizedThreadStart pst = new ParameterizedThreadStart(p =&gt; SearchModule(module, value));
      Thread t = new Thread(pst);
      t.Start(); }
  
  private unsafe void SearchModule(ProcessModule module, string value)
  {
  Process process = getProcess;
  int iVal;
  double dVal;
  int.TryParse(value, out iVal);
  double.TryParse(value, out dVal);
  for (Int64 addr = (Int64)module.BaseAddress; addr + value.Length &lt; (Int64)module.BaseAddress + module.ModuleMemorySize; addr++)
  {
      // Compare ints
      if (iVal &gt; 0)
      {
          byte[] ExpectedBytes = BitConverter.GetBytes(iVal);
          byte[] ActualBytes = ReadMemoryBytes(module, (IntPtr)addr, (uint)ExpectedBytes.Length, (IntPtr)addr);
  
          bool isMatch = true;
          for (int i = 0; i &lt; ExpectedBytes.Length; i++)
              if (ExpectedBytes[i] != ActualBytes[i])
                  isMatch = false;
          if (isMatch)
              PossibleAddresses.Add((IntPtr)addr);
      }
  }
  
  private byte[] ReadMemoryBytes(ProcessModule mod, IntPtr memAddress, uint size, IntPtr BaseAddress)
  {
      byte[] buffer = new byte[size];
      IntPtr bytesRead;
      unsafe
      {
          ReadProcessMemory(processPointer, BaseAddress, buffer, size, out bytesRead);
          return buffer;
      }
  }
  
  [DllImport("kernel32.dll")]
  public static extern IntPtr OpenProcess(UInt32 dwDesiredAccess, Int32 bInheritHandle, UInt32 dwProcessId);
  [DllImport("kernel32.dll")]
  public static extern Int32 CloseHandle(IntPtr hObject);
  [DllImport("kernel32.dll")]
  public static extern Int32 ReadProcessMemory(IntPtr hProcess, IntPtr lpBaseAddress, [In, Out] byte[] buffer, UInt32 size, out IntPtr lpNumberOfBytesRead);
  </code></pre>