Three shall be the number thou shall count, and the number of the counting shall be three...

quote:
Original post by Witchcraven
Im no expert on windows, but it would seem to me you would need a process running on a lower rung than the application you want to read. Its been a while since I have dealt with rungs and memory protection crap though. Can you run code in rung 0 on windows?
DWORD CALLBACK FindValue(LPVOID lpParam)
{
MEMORY_BASIC_INFORMATION m;
int nMatches = 0;
LPSEARCHINFO s = (LPSEARCHINFO)lpParam;
DWORD br, dwRegionSize, tmp;
char lpTxt[100];
unsigned char *lpSearchBuffer;
VirtualQueryEx(s->hProcess, (void *)0x00400000, &m, sizeof m);
dwRegionSize = m.RegionSize;
for(int i=(int)m.BaseAddress;i<0x80000000;i+=m.RegionSize)
{
VirtualQueryEx(s->hProcess, (void *)i, &m, sizeof m);
if(m.Protect != PAGE_NOACCESS)
{
lpSearchBuffer = new unsigned char[m.RegionSize];
ReadProcessMemory(s->hProcess, m.BaseAddress, lpSearchBuffer, m.RegionSize, &br);
if(br)
{
tmp = br - s->nSize;
for(DWORD j=0;j<=tmp;j++)
{
if(!memcmp(lpSearchBuffer+j, &s->dwValue, s->nSize))
{
nMatches++;
sprintf(lpTxt, "%x", i+j);
SendDlgItemMessage(s->hWnd, IDC_MATCHES, LB_ADDSTRING, 0, (LPARAM)lpTxt);
}
}
}
delete [] lpSearchBuffer;
}
SendDlgItemMessage(s->hWnd, IDC_PROGRESS1, PBM_STEPIT, 0, 0);
}
sprintf(lpTxt, "Found %d matches.", nMatches);
MessageBox(s->hWnd, lpTxt, "Search finished!", MB_ICONINFORMATION);
return 0;
}
This topic has been locked by a moderator. New replies are not allowed.
With your permission, GameDev.net uses analytics cookies to understand how people use the platform. You can accept analytics or continue with necessary cookies only. Learn more