This code based off some info found in this thread.
How to Test?
-------------------
-Open a blank notepad.
-Check Unicode Exe in compile options.
-Type random text in notepad.
-Change findString.
-Press F5.
Testing against Cheat Engine's results give 100% exact matches.
There's not many comments, but there's not really much to say either. VirtualQueryEx gives valid memory blocks, ReadProcessMemory grabs the data in the blocks and we loop through to see if we have a match.
Code: Select all
;Epidemicz - 12/30/2010 PB 4.51 x86
;====================================
;Basic Memory Scanner Test Proof
;====================================
;Compile in unicode to test on notepad
;Find Window
HWND = FindWindow_(NULL, "Untitled - Notepad")
;Get ProcessID
GetWindowThreadProcessId_(HWND, @pid)
address=0
maxAddress=$7FFFFFFF
; findNumber=0 - uncomment to use with number method
findString$="LOL123LOL456"
len=Len(findString$)
;Opens Process With full access
hProcess = OpenProcess_(#PROCESS_ALL_ACCESS, #False, pid);
Repeat
result=VirtualQueryEx_(hProcess, address, @mbi.MEMORY_BASIC_INFORMATION, SizeOf(MEMORY_BASIC_INFORMATION))
If mbi\State = #MEM_COMMIT And mbi\Protect <> #PAGE_READONLY And mbi\Protect <> #PAGE_EXECUTE_READ And mbi\Protect <> #PAGE_GUARD And mbi\Protect <> #PAGE_NOACCESS
sBuffer=AllocateMemory(mbi\RegionSize)
res=ReadProcessMemory_(hProcess, address, sBuffer, mbi\RegionSize, @written)
If written > 0
For x = 0 To written
;string method - use to find text
;================
tmp$=PeekS(sBuffer+x, len) ;string length ! important
If FindString(tmp$, findString$, 1)
Debug "FOUND MATCH - " + Hex(mbi\BaseAddress+x) + "=" + tmp$
EndIf
;number method - use to find number value
;==============
; tmp=PeekL(sBuffer+x)
; If tmp=findNumber
; Debug "FOUND MATCH - " + Hex(mbi\BaseAddress + x) + "=" + Str(tmp)
; EndIf
Next
EndIf
FreeMemory(sBuffer)
EndIf
address=mbi\BaseAddress+mbi\RegionSize
Until address >= maxAddress Or result=0
End
