lpBaseAddress

lpBaseAddress is a parameter name used in Windows API memory operations that act on another process’s address space, most notably ReadProcessMemory and WriteProcessMemory. It designates the base address in the target process from which the operation begins. The parameter is typically of type LPCVOID (a pointer to a constant void), and in code you pass the address of the location in the remote process, usually by casting from a pointer-sized integer or void*.

In a ReadProcessMemory call, the function copies a specified number of bytes from the remote process, starting at lpBaseAddress, into a buffer supplied by the caller. In a WriteProcessMemory call, it copies bytes from the caller’s buffer into the remote process at lpBaseAddress. Importantly, the memory being accessed belongs to the target process; the operation uses the handle to that process and requires appropriate access rights.

lpBaseAddress may point to memory allocated within the target process (for example, via VirtualAllocEx) or to the base address of a loaded module, such as a DLL, within that process. Offsets relative to this base can be used to locate specific data structures or code regions.

Practical use of lpBaseAddress requires sufficient privileges and an understanding of the target process’s memory protections (for example, pages must be readable or writable as appropriate, as determined by VirtualQueryEx). Developers should account for differences between 32-bit and 64-bit processes and for address space layout randomization when identifying valid addresses.