title: WriteProcessMemory for VirtualBox C++ : Invalid address
body: <p>I have a program which scans a whole process to find a desired string, then write it with a different string. So it works for normal processes which are <strong>outside VirtualBox</strong>. The problem is that it can detect the string in a process inside a running VirtualBox process but when I use the same address to write data, the program continues to say : "<strong>Attempt to access invalid address</strong>".</p>
  
  <p>Here is the output, 2656 is PID of a running VirtualBox that contains the desired string : </p>
  
  <pre><code>Memory Changer Program
  + PID : 2656
    String found : ABCDE12345
    Address found : 0x45ab0830
    Block size : 2097154
    Failed to enable Memory Permission.
    Attempt to access invalid address.
  
    Attempt to write with 12345ABCDE. . .
    Contents written failed.
    Attempt to access invalid address.
  
  Operation failed.
  </code></pre>
  
  <p>I have my process privilege enabled, and I open the process with flags : </p>
  
  <p><code>PROCESS_QUERY_INFORMATION | PROCESS_VM_READ | PROCESS_VM_WRITE | PROCESS_VM_OPERATION</code></p>
  
  <p>I enable Memory Permission by using VirtualProtect. As I said before, my program works very well for normal processes outside VirtualBox. I am using Windows XP 32 bit.</p>
  
  <p>What is the cause that my program can read memory but cannot write memory for this certain process? Thank you.</p>
  
  <p>Edit : I notice that the address is abnormally too high, does it mean WriteProcessMemory will fail? And how to get the true address of it?</p>
  
  <p>When I close the string process and open the process again in the running VirtualBox process (Still PID 2656), my Memory Changer program can still detect the desired string, but the base address is <code>0x31c6a830</code> which looks too different. I wonder if they are just virtual memory addresses not real memory addresses but I don't know how to deal with it.</p>
  
  <p>There is a structure of my interest, but I don't know how to use it. It may be the solution to the problem.</p>
  
  <pre><code>typedef struct _MEMORY_BASIC_INFORMATION_VLM {
      union {
          PVOID64 BaseAddress;
          ULONGLONG BaseAddressAsUlongLong;
      };
      union {
          PVOID64 AllocationBase;
          ULONGLONG AllocationBaseAsUlongLong;
      };
      ULONGLONG RegionSize;
      DWORD AllocationProtect;
      DWORD State;
      DWORD Protect;
      DWORD Type;
  } MEMORY_BASIC_INFORMATION_VLM, *PMEMORY_BASIC_INFORMATION_VLM;
  </code></pre>