Toolhelp32ReadProcessMemory function (tlhelp32.h)

Article
02/22/2024

Copies memory allocated to another process into an application-supplied buffer.

Syntax

BOOL Toolhelp32ReadProcessMemory(
  [in]  DWORD   th32ProcessID,
  [in]  LPCVOID lpBaseAddress,
  [out] LPVOID  lpBuffer,
  [in]  SIZE_T  cbRead,
  [out] SIZE_T  *lpNumberOfBytesRead
);

Parameters

[in] th32ProcessID

The identifier of the process whose memory is being copied. This parameter can be zero to copy the memory of the current process.

[in] lpBaseAddress

The base address in the specified process to read. Before transferring any data, the system verifies that all data in the base address and memory of the specified size is accessible for read access. If this is the case, the function proceeds. Otherwise, the function fails.

[out] lpBuffer

A pointer to a buffer that receives the contents of the address space of the specified process.

[in] cbRead

The number of bytes to read from the specified process.

[out] lpNumberOfBytesRead

The number of bytes copied to the specified buffer. If this parameter is NULL, it is ignored.

Return value

Returns TRUE if successful.

Remarks

This function opens a handle to the target process and closes it once the read operation has completed. If you're planning to perform several reads, use ReadProcessMemory instead.

Requirements

Requirement	Value
Minimum supported client	Windows XP [desktop apps only]
Minimum supported server	Windows Server 2003 [desktop apps only]
Target Platform	Windows
Header	tlhelp32.h
Library	Kernel32.lib
DLL	Kernel32.dll