SRL Archive - Help

Reading Memory


caused

2012-05-24 05:25:09

Hey,
does simba have functions implemented for reading the Memory of a certain application ?

Main

2012-05-24 05:31:58

I don't think so :(

mormonman

2012-05-24 05:34:22

You can do it through a plugin.

caused

2012-05-24 06:35:28

From: caused
Hey,
does simba have functions implemented for reading the Memory of a certain application ?


From: mormonman
You can do it through a plugin.


Is there a plugin out there that offers such functions ?

Nava2

2012-05-24 07:30:49

You could implement it. Just use a PChar (I think, either way I mean a pointer to a char) and point it to a memory location.. primitve, but it will do what you want.

I think Simba can already get Process information.

bg5

2012-05-24 12:05:53

Yes ,it would be cool to implement memory reading for Simba!

From: caused
Is there a plugin out there that offers such functions ?


If someone is thinking about doing such plugin ,maybe will be interested:

http://code.google.com/p/cheat-engine/source/browse/trunk/Cheat%20Engine/memscan.pas

caused

2012-05-24 13:30:37

From: Nava2
You could implement it. Just use a PChar (I think, either way I mean a pointer to a char) and point it to a memory location.. primitve, but it will do what you want.

I think Simba can already get Process information.


Could you give me an example for that ?

masterBB

2012-05-24 14:13:39

The function simba uses for getting the process information is EnumWindows. Linky Link to resources.

This loops through all the windows and gets the HWND. Which can be used for stuff like this. Note that this works differently in linux.

Just search through the windows api and create a plugin.

bg5

2012-05-24 15:01:14

For reading memory in windows you would propably need
This and This.

Brandon

2012-05-24 15:15:04

Not sure if I had to actually stdcall and extern all of these because I'm pretty sure pascal has SOME of these natively but anyway.. I can confirm that with an extension, FindWindow and SetParent works.. I haven't tested the alloc and free or any of the process functions but they should indeed work else you'd be writing a plugin instead of an extension.. short example:


function FindWindow(ClassName, WindowName: PChar): HWND; external 'FindWindowA@User32.dll stdcall';

function SetParent(Child, Parent: HWND): HWND; external 'SetParent@User32.dll stdcall';

function VirtualFreeEx(hProcess: THANDLE; lpAddress: Pointer; dwSize: LongWord; dwFreeType: LongWord): Boolean; external 'VirtualFreeEx@Kernel32.dll stdcall';

function VirtualAllocEx(hProcess: THANDLE; lpAddress: Pointer; dwSize: LongWord; flAllocationType: LongWord; flProtect: LongWord): POINTER; external 'VirtualAllocEx@Kernel32.dll stdcall';

function GetWindowThreadProcessId(WindowHandle: HWND; var dwProcessId: LongWord): LongWord; external 'GetWindowThreadProcessId@User32.dll stdcall';

function OpenProcess(dwDesiredAccess: LongWord; bInheritHandle: Boolean; dwProcessId: LongWord): THANDLE; external 'OpenProcess@Kernel32.dll stdcall';

function ReadProcessMemory(hProcess: THANDLE; lpBaseAddress: Pointer; lpBuffer: Pointer; nSize: LongInt; dwBytesRead: LongWord): Boolean; external 'ReadProcessMemory@Kernel32.dll stdcall';

//Usage:

Function ReadInject: Boolean;
var
WindowHandle: HWND; //HANDLE.
PHandle: THandle; //HANDLE.
PID, ThreadID, BytesRead: LongWord; //DWORD.
ProcessBuffer, Something: Pointer; //void* aka LPVoid.
begin
try
//Grab a handle to the desired window..
WindowHandle:= FindWindow('SunAwtFrame', 'Public SMARTv6.9 - SMART Minimizing Autoing Resource Thing - By BenLand100');

//Get PID By Window Handle..
ThreadID:= GetWindowThreadProcessID(WindowHandle, PID);

//Get OpenProcess Handle From PID..
PHandle:= OpenProcess(PROCESS_ALL_ACCESS, False, PID);
if (PHandle <> 0) then
begin
//Allocate Space for the buffer..
ProcessBuffer := VirtualAllocEx(PHandle, nil, BUFFER_SIZE, MEM_COMMIT, PAGE_READWRITE);

//Fill the buffer with some information from a window or button or whatever..
SendMessage(WindowHandle, WM_GETTEXT, WindowID, Integer(ProcessBuffer));

//Read Process Memory Address..
ReadProcessMemory(ThreadID, ProcessBuffer, Something, SizeOf(SomethingsDataType), BytesRead);

//Free Allocated Buffer Memory..
VirtualFreeEx(taskbarProcessHandle, taskbarProcessBuffer, 0, MEM_RELEASE);
end;
finally
CloseHandle(PHandle); //external 'CloseHandle@Kernel32.dll stdcall'.
end;
end;