How does Cheat O'Matic work?

Question

How does this program access other processes memory? How can it write into the address space of another process? Wasn't it supposed to segfault or something?

Answer 1

A program with a system privilege level is capable of mapping physical addresses to its own virtual address.

Cheat O'Matic (and poke) maps the physical address of whatever program it is trying to scan into its own virtual space.

Once this is done, it scans all the bytes for the target value you enter. It isolates the correct memory address by asking the user to altering the address to known values and basically does a diff between the old and new memory to find the changes.

Answer 2

One way to do it is to inject a DLL (Google for 'Dll injection') into the address process that you want to spy on: that DLL is then inside the process and can do things with the process' memory. The spy process can use an Interprocess Communication method (pipes, sockets, anything) to talk with the DLL which it injected into the other process.

Injecting a DLL takes administrator priviledge (e.g. to set a relevent entry in the system registry).