Advertisement
McFree

Memory Class

Mar 2nd, 2017
104
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. class memory
  2. {
  3.     static baseAddress, hProcess
  4.     , insertNullTerminator := True
  5.     , readChunkSize := 128
  6.     , aTypeSize := {    "UChar": 1, "Char": 1
  7.     , "UShort": 2, "Short": 2
  8.     , "UInt": 4, "Int": 4
  9.     , "UFloat": 4, "Float": 4
  10.     ,   "Int64": 8, "Double": 8}
  11.     __new(program, dwDesiredAccess := "", byRef handle := "", windowMatchMode := 3)
  12.     {
  13.         if !(handle := this.openProcess(program, dwDesiredAccess, windowMatchMode))
  14.         return ""
  15.         this.BaseAddress := this.getProcessBaseAddress(program, windowMatchMode)
  16.         return this
  17.     }
  18.     __delete()
  19.     {
  20.         this.closeProcess(this.hProcess)
  21.         return
  22.     }
  23.     openProcess(program, dwDesiredAccess := "", windowMatchMode := 3)
  24.     {
  25.         if dwDesiredAccess is not integer
  26.         dwDesiredAccess := (PROCESS_QUERY_INFORMATION := 0x0400) | (PROCESS_VM_OPERATION := 0x8) | (PROCESS_VM_READ := 0x10) | (PROCESS_VM_WRITE := 0x20)
  27.         if windowMatchMode
  28.         {
  29.             mode := A_TitleMatchMode
  30.             SetTitleMatchMode, %windowMatchMode%
  31.         }
  32.         WinGet, pid, pid, % this.currentProgram := program
  33.         if windowMatchMode
  34.         SetTitleMatchMode, %mode%
  35.         if !pid
  36.         return this.hProcess := 0
  37.         return this.hProcess := DllCall("OpenProcess", "UInt", dwDesiredAccess, "Int", False, "UInt", pid)
  38.     }
  39.     closeProcess(hProcess)
  40.     {
  41.         if hProcess
  42.         return DllCall("CloseHandle", "UInt", hProcess)
  43.         return
  44.     }
  45.     read(address, type := "UInt", aOffsets*)
  46.     {
  47.         VarSetCapacity(buffer, bytes := this.aTypeSize[type])
  48.         if !DllCall("ReadProcessMemory","UInt", this.hProcess, "UInt", aOffsets.maxIndex() ? this.getAddressFromOffsets(address, aOffsets*) : address, "Ptr", &buffer, "UInt", bytes, "Ptr",0)
  49.         return !this.hProcess ? "Handle Is closed: " this.hProcess : "Fail"
  50.         return numget(buffer, 0, Type)
  51.     }
  52.     ReadRawMemory(address, byref buffer, bytes := 4, aOffsets*)
  53.     {
  54.         VarSetCapacity(buffer, bytes)
  55.         if !DllCall("ReadProcessMemory", "UInt", this.hProcess, "UInt", aOffsets.maxIndex() ? this.getAddressFromOffsets(address, aOffsets*) : address, "Ptr", &buffer, "UInt", bytes, "Ptr*", bytesRead)
  56.         return !this.hProcess ? "Handle Is closed: " this.hProcess : "Fail"
  57.         return bytesRead
  58.     }
  59.     readString(address, length := 0, encoding := "utf-8", aOffsets*)
  60.     {
  61.         size := (encoding ="utf-16" || encoding = "cp1200") ? 2 : 1
  62.         VarSetCapacity(buffer, length ? length * size : (this.readChunkSize < size ? this.readChunkSize := size : this.readChunkSize), 0)
  63.         if aOffsets.maxIndex()
  64.         address := this.getAddressFromOffsets(address, aOffsets*)
  65.         if !length
  66.         {
  67.             VarSetCapacity(string, this.readChunkSize * 2)
  68.             Loop
  69.             {
  70.                 success := DllCall("ReadProcessMemory", "UInt", this.hProcess, "UInt", address + (A_index - 1) * this.readChunkSize, "Ptr", &buffer, "Uint", this.readChunkSize, "Ptr", 0)
  71.                 if (ErrorLevel || !success)
  72.                 {
  73.                     if (A_Index = 1 && !this.hProcess)
  74.                     return "Handle Is closed: " this.hProcess
  75.                     else if (A_index = 1 && this.hProcess)
  76.                     return "Fail"
  77.                     else
  78.                     break
  79.                 }
  80.                 loop, % this.readChunkSize / size
  81.                 {
  82.                     if ("" = char := StrGet(&buffer + (A_Index -1) * size, 1, encoding))
  83.                     break, 2
  84.                     string .= char
  85.                 }
  86.             }
  87.         }
  88.         Else
  89.         {
  90.             if !DllCall("ReadProcessMemory", "UInt", this.hProcess, "UInt", address, "Ptr", &buffer, "Uint", length * size, "Ptr", 0)
  91.             return !this.hProcess ? "Handle Is closed: " this.hProcess : "Fail"
  92.             string := StrGet(&buffer, length, encoding)
  93.         }
  94.         return string
  95.     }
  96.     writeString(address, string, encoding := "utf-8", aOffsets*)
  97.     {
  98.         encodingSize := (encoding = "utf-16" || encoding = "cp1200") ? 2 : 1
  99.         requiredSize := StrPut(string, encoding) * encodingSize - (this.insertNullTerminator ? 0 : encodingSize)
  100.         VarSetCapacity(buffer, requiredSize)
  101.         StrPut(string, &buffer, this.insertNullTerminator ? StrLen(string) : StrLen(string) + 1, encoding)
  102.         DllCall("WriteProcessMemory", "UInt", this.hProcess, "UInt", aOffsets.maxIndex() ? this.getAddressFromOffsets(address, aOffsets*) : address, "Ptr", &buffer, "Uint", requiredSize, "Ptr*", BytesWritten)
  103.         return BytesWritten
  104.     }
  105.     write(address, value, type := "Uint", aOffsets*)
  106.     {
  107.         if !bytes := this.aTypeSize[type]
  108.         return "Non Supported data type"
  109.         VarSetCapacity(buffer, bytes)
  110.         NumPut(value, buffer, 0, type)
  111.         return DllCall("WriteProcessMemory", "UInt", this.hProcess, "UInt", aOffsets.maxIndex() ? this.getAddressFromOffsets(address, aOffsets*) : address, "Ptr", &buffer, "Uint", bytes, "Ptr", 0)
  112.     }
  113.     pointer(base, finalType := "UInt", offsets*)
  114.     {
  115.         For index, offset in offsets
  116.         {
  117.             if (index = offsets.maxIndex() && A_index = 1)
  118.             pointer := offset + this.Read(base)
  119.             Else
  120.             {
  121.                 IF (A_Index = 1)
  122.                 pointer := this.Read(offset + this.Read(base))
  123.                 Else If (index = offsets.MaxIndex())
  124.                 pointer += offset
  125.                 Else pointer := this.Read(pointer + offset)
  126.             }
  127.         }
  128.         Return this.Read(offsets.maxIndex() ? pointer : base, finalType)
  129.     }
  130.     getAddressFromOffsets(address, aOffsets*)
  131.     {
  132.         lastOffset := aOffsets.Remove()
  133.         return  this.pointer(address, "UInt", aOffsets*) + lastOffset
  134.     }
  135.     getProcessBaseAddress(WindowTitle, windowMatchMode := 3)
  136.     {
  137.         if windowMatchMode
  138.         {
  139.             mode := A_TitleMatchMode
  140.             SetTitleMatchMode, %windowMatchMode%
  141.         }
  142.         WinGet, hWnd, ID, %WindowTitle%
  143.         if windowMatchMode
  144.         SetTitleMatchMode, %mode%
  145.         if !hWnd
  146.         return
  147.         BaseAddress := DllCall(A_PtrSize = 4
  148.         ? "GetWindowLong"
  149.         : "GetWindowLongPtr", "Ptr", hWnd, "Uint", -6, "UInt")
  150.         return BaseAddress
  151.     }
  152.     getBaseAddressOfModule(module := "")
  153.     {
  154.         if !this.hProcess
  155.         return -2
  156.         if (A_PtrSize = 4)
  157.         {
  158.             DllCall("IsWow64Process", "Ptr", this.hProcess, "Int*", result)
  159.             if !result
  160.             return -4
  161.         }
  162.         if !module
  163.         {
  164.             VarSetCapacity(mainExeNameBuffer, 2048 * (A_IsUnicode ? 2 : 1))
  165.             DllCall("psapi\GetModuleFileNameEx", "Ptr", this.hProcess, "Uint", 0
  166.             , "Ptr", &mainExeNameBuffer, "Uint", 2048 / (A_IsUnicode ? 2 : 1))
  167.             mainExeName := StrGet(&mainExeNameBuffer)
  168.         }
  169.         size := VarSetCapacity(lphModule, 4)
  170.         loop
  171.         {
  172.             DllCall("psapi\EnumProcessModules", "Ptr", this.hProcess, "Ptr", &lphModule
  173.             , "Uint", size, "Uint*", reqSize)
  174.             if ErrorLevel
  175.             return -3
  176.             else if (size >= reqSize)
  177.             break
  178.             else
  179.             size := VarSetCapacity(lphModule, reqSize)
  180.         }
  181.         VarSetCapacity(lpFilename, 2048 * (A_IsUnicode ? 2 : 1))
  182.         loop % reqSize / A_PtrSize
  183.         {
  184.             DllCall("psapi\GetModuleFileNameEx", "Ptr", this.hProcess, "Uint", numget(lphModule, (A_index - 1) * A_PtrSize)
  185.             , "Ptr", &lpFilename, "Uint", 2048 / (A_IsUnicode ? 2 : 1))
  186.             if (!module && mainExeName = StrGet(&lpFilename) || module && instr(StrGet(&lpFilename), module))
  187.             {
  188.                 VarSetCapacity(MODULEINFO, A_PtrSize = 4 ? 12 : 24)
  189.                 DllCall("psapi\GetModuleInformation", "Ptr", this.hProcess, "UInt", numget(lphModule, (A_index - 1) * A_PtrSize)
  190.                 , "Ptr", &MODULEINFO, "UInt", A_PtrSize = 4 ? 12 : 24)
  191.                 return numget(MODULEINFO, 0, "Ptr")
  192.             }
  193.         }
  194.         return -1
  195.     }
  196. }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement