WriteProcessMemory

WriteProcessMemory is a Windows API function that writes data into the memory of another process. It transfers bytes from the calling process’s buffer into the target process’s virtual address space, starting at a specified base address. The operation requires a valid handle to the target process with sufficient access rights and is commonly used in debugging, inter-process communication, or memory patching. It is part of the Windows API and is exported from Kernel32.dll.

The function signature is BOOL WriteProcessMemory(

HANDLE hProcess,

LPVOID lpBaseAddress,

LPCVOID lpBuffer,

SIZE_T nSize,

SIZE_T *lpNumberOfBytesWritten

). hProcess is a handle to the target process obtained via OpenProcess with appropriate access. lpBaseAddress specifies the address in the target process where writing begins. lpBuffer is a pointer to the data in the calling process. nSize is the number of bytes to write. lpNumberOfBytesWritten, when non-NULL, receives the number of bytes actually written. The function returns a nonzero value on success and zero on failure; GetLastError provides extended error information.

Behavior and requirements: The target memory region must be valid and writable under its current protection. If necessary, memory protections can be changed in the target process with VirtualProtectEx. WriteProcessMemory attempts to write exactly nSize bytes; if only part can be written (due to protections or other issues), the number of bytes written is reported, and the function may fail with an error such as ERROR_PARTIAL_COPY. It does not automatically allocate memory in the target process.

Related functions include ReadProcessMemory, OpenProcess, VirtualAllocEx, and VirtualProtectEx. Use of WriteProcessMemory is common in debuggers and certain inter-process communication schemes, but it can also be misused for code injection or other intrusive actions, so it is subject to security and privilege considerations.