Advertisement
Guest User

Read Memory Module + Pointer

a guest
Oct 6th, 2018
485
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 1.69 KB | None | 0 0
  1. #include <NomadMemory.au3>
  2. SetPrivilege("SeDebugPrivilege", 1)
  3. $pid = ProcessExists("Proc.exe")
  4. Global $Offset[6] = [0, 0x258, 0x1f8, 0X2f0, 0X718, 0X6b8]
  5. $openmem = _MemoryOpen($pid) ; Open the memory
  6. $ModuleOffset = 0x000BE72C ; điền cái số ở dòng "xxx.dll" +0x??? tìm dc trong CE vào
  7. $baseAddr = _MemoryModuleGetBaseAddress($iPID, "xxx.dll") + $ModuleOffset
  8. $finalADDR = "0x" & Hex($baseADDR + $StaticOffset)
  9. $Value = _MemoryPointerRead($finalADDR, $openmem, $Offset)
  10. _MemoryClose($openmem)
  11. ConsoleWrite ( "Address = " & $Value[0] & @CRLF & "Value = " & $Value[1] & @CRLF)
  12.  
  13. Func _memorymodulegetbaseaddress($ipid, $smodule)
  14. If NOT ProcessExists($ipid) Then Return SetError(1, 0, 0)
  15. If NOT IsString($smodule) Then Return SetError(2, 0, 0)
  16. Local $psapi = DllOpen("psapi.dll")
  17. Local $hprocess
  18. Local $permission = BitOR(2, 1024, 8, 16, 32)
  19. If $ipid > 0 Then
  20. Local $hprocess = DllCall("kernel32.dll", "ptr", "OpenProcess", "dword", $permission, "int", 0, "dword", $ipid)
  21. If $hprocess[0] Then
  22. $hprocess = $hprocess[0]
  23. EndIf
  24. EndIf
  25. Local $modules = DllStructCreate("ptr[1024]")
  26. Local $acall = DllCall($psapi, "int", "EnumProcessModules", "ptr", $hprocess, "ptr", DllStructGetPtr($modules), "dword", DllStructGetSize($modules), "dword*", 0)
  27. If $acall[4] > 0 Then
  28. Local $imodnum = $acall[4] / 4
  29. Local $atemp
  30. For $i = 1 To $imodnum
  31. $atemp = DllCall($psapi, "dword", "GetModuleBaseNameW", "ptr", $hprocess, "ptr", Ptr(DllStructGetData($modules, 1, $i)), "wstr", "", "dword", 260)
  32. If $atemp[3] = $smodule Then
  33. DllClose($psapi)
  34. Return Ptr(DllStructGetData($modules, 1, $i))
  35. EndIf
  36. Next
  37. EndIf
  38. DllClose($psapi)
  39. Return SetError(-1, 0, 0)
  40. EndFunc
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement