c# kernel32.dll readprocessmemory windows 11 returns error 299

Question

I've implemented the ReadProcessMemory function from kernel32.dll using C# PInvoke. Compiling and installing on Windows 10 it functions flawlessly. However, installing the same program in Windows 11, it throws error 299 both in running with administrator privileges and not.

Here is the c# code:

[DllImport("kernel32.dll", SetLastError = setLastError)]
[return: MarshalAs(UnmanagedType.Bool)]
public static extern bool ReadProcessMemory(
    [In] IntPtr hProcess,
    [In] IntPtr lpBaseAddress,
    [Out] byte[] lpBuffer,
    [In] UIntPtr dwSize,
    [Out] out UIntPtr lpNumberOfBytesRead
);

And I use Process.Handle for hProcess. But since it works on Windows 10, the same compiled code, not recompiled I cant image it is wrong. Most likely some setting on Windows that does not allow for one process to read the memory of another process even though we are running with administrator privileges.

@isomania Error 299 means "Only part of a ReadProcessMemory or WriteProcessMemory request was completed". So check the address range you are requesting. — GSerg
– GSerg, Commented May 14, 2024 at 14:51
Okay further testing shows that the memory region is PAGE_NOACCESS on Windows 11 and PAGE_READWRITE on Windows 10. Running VirtualProtectEx yields in (0x5) ERROR_ACCESS_DENIED even tough I'm running in Administrator privileges. What has been modified in Windows 11 secrecy update to make this change? And how can I modify it back? — isomania
– isomania, Commented May 15, 2024 at 6:16

isomania · Accepted Answer · 2024-05-15 09:24:52Z

0

After installing the following two Windows updates:

 2024-05 .NET 8.0.5  Security Update for x64 Client (KB5038352)
 2024-05 .NET 6.0.30 Security Update for x64 Client (KB5038350)

It works as intended on Windows 11.

edited May 15, 2024 at 9:24

answered May 15, 2024 at 9:18

isomania

193 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

c# kernel32.dll readprocessmemory windows 11 returns error 299

1 Answer 1

Comments

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Related