All pastes #1430823 Raw Edit

SearchProcessMemory

public c v1 · immutable
#1430823 ·published 2009-05-22 09:38 UTC
rendered paste body
int findBytes(char *b, int bl, char *f, int fl){  int i=0,x;  for (;i<bl-fl;i++)     for (x=0;x<fl;x++)       if (b[i+x]!=f[x]) break;       else if (x==fl-1) return i;  return -1;}long SearchProcessMemory(HANDLE p, unsigned long baseaddr, char *find, int len){  SYSTEM_INFO si;  MEMORY_BASIC_INFORMATION mi;  char *ThisRegion;  long offset;  unsigned long i,x,bytesRead;  GetSystemInfo(&si);  VirtualQueryEx(p, (LPVOID)baseaddr, &mi, sizeof(mi));  i = (unsigned long)mi.AllocationBase+baseaddr;  while(i <= (unsigned long)si.lpMaximumApplicationAddress)  {    VirtualQueryEx(p, (LPVOID)i, &mi, sizeof(mi));    if (mi.State == MEM_COMMIT)     {      ThisRegion = (char *)malloc(mi.RegionSize);      ReadProcessMemory(p, (LPVOID)i, ThisRegion, mi.RegionSize, &bytesRead);      offset = findBytes(ThisRegion, bytesRead, find, len);      free(ThisRegion);      if (bytesRead > 0 && offset != -1) return (i+offset);    }    if (mi.RegionSize == 0) break;    i += (unsigned long)mi.RegionSize;  }  return 0;}