Reading Memory & Hooking

[Imperceptus]

I want to moniter a specific address on an application for change. Is the best way to do this, to use a timer reading the memory at an interval?  And no this isn't for a game hack.

[Barabajagal]

A timer would work, but the "best" way depends on the nature of the change. Is it a quick fluctuation, going from one value to another and back? Is it a change from one to another that happens over time? Depending on the amount and rate of change, different methods can be employed for better results.

[Imperceptus]

The change is erratic at best. I am thinking polling the memory for change may not be the best solution. Setting a timer to catch the change would require an interval less then 100 and that does not do well for cpu usage.

[Imperceptus]

Instead of reading the memory of the application. Can I copy the control that the data is appearing in that I wish to examine?  I have the Pointer for the control. Not to sure how I could copy the contents of the application control though. Its a treeview.

[Barabajagal]

What are you trying to get from the treeview? You could probably hook window messages instead of dealing with the raw memory...

[Imperceptus]

The application using the treeview is ventrilo. I am trying to check for when people talk. So it would be when an image changes in the treeview. looking through the hook concepts on msdn. that might what i need to do.

[TheMinistered]

well you could try polling, using timers, or using hooks.  the easiest is by far polling, you just loop checking for changes, timers are not much harder same concept but loop with a delay.  hooking is the best route imho but a little more complicated... you just need to find out where it handles incoming talks and hook that function so when it gets called you know someones talking... etc newho im out!

[MyndFyre]

I want to moniter a specific address on an application for change.

Generally speaking, for this task (not the one you described in later posts), you could use the x86 debugging support to be notified each time the address changes by tripping a breakpoint.

[Imperceptus]

Thanks guys, google here I come.