Geek asks and answers

Scan all process memory with ReadProcessMemory

I try to scan all the process memory, but I don’t have time ... What am I doing: I use notepad for tests, so I write % B there , and these values ​​in HEX: 25 (%) and 42 (B). So the code:

  while (VirtualQueryEx(PIDHandle, Pointer(MemStart), MemInfo, SizeOf(MemInfo)) <> 0) do
    begin
      if ((MemInfo.State = MEM_COMMIT) and (not (MemInfo.Protect = PAGE_GUARD)
        or (MemInfo.Protect = PAGE_NOACCESS)) and (MemInfo.Protect = PAGE_READWRITE)) then
          begin
            SetLength(Buff, MemInfo.RegionSize);
              if (ReadProcessMemory(PIDHandle, MemInfo.BaseAddress, Buff,
                                        MemInfo.RegionSize, ReceivedBytes)) then
                begin
                for I := 0 to SizeOf(Buff) do
                 begin
   if (IntToHex(Buff[i], 1) = '25') and (IntToHex(Buff[i+2], 1) = '42') then
                  Form1.Memo1.Lines.Append(IntToHex(Buff[i], 1));
                 end;

                end;
          end;
      MemStart:= MemStart + MemInfo.RegionSize;
    end;
  CloseHandle(PIDHandle);
  end;

var 'Buff' - TBytes (I read about TBytes and think it is the same as an array of bytes). Therefore, I convert bytes to Hex and look for the values: 25 and 42, respectively. The code looks like this:

if (IntToHex(Buff[i], 1) = '25') and (IntToHex(Buff[i+2], 1) = '42') then

Because there is 00 between the hexadecimal values. Therefore, I need to add "+2". How to scan all memory for these values?

+3
source share
1 answer

, UTF-16, $0025 $0042.

, . hex, . - -16. , 32 20, 32=$20. :

if (Buff[i]=$25) and (Buff[i+2]=$42) then

, $00, :

var
  Target: string;
....
Target := '%B';
if CompareMem(@Buff[i], @Target[1], Length(Target)*SizeOf(Char)) then
  ....

,

for I := 0 to SizeOf(Buff) do

.

  • SizeOf(Buff) , . , SizeOf .
  • Length SizeOf, . , 0 Length(...)-1.
  • i+2 , 0 Length(...)-3.

4 , . , :

TargetByteLength = Length(Target)*SizeOf(Char);
for i := 0 to Length(Buff)-TargetByteLength do
  if CompareMem(@Buff[i], @Target[1], TargetByteLength) then
    ....
+8

More articles:


All Articles