Jump to content
Xtreme .Net Talk

Recommended Posts

Posted

I found an example on Mentalis.org that reads the process memory, however I have been trying to convert this to VB.net without any success, and I was hoping for some help.

 

Private Const PROCESS_ALL_ACCESS As Long = &H1F0FFF
Private Declare Function GetWindowThreadProcessId Lib "user32" (ByVal hWnd As Long, lpdwProcessId As Long) As Long
Private Declare Function OpenProcess Lib "kernel32" (ByVal dwDesiredAccess As Long, ByVal bInheritHandle As Long, ByVal dwProcessId As Long) As Long
Private Declare Function ReadProcessMemory Lib "kernel32" (ByVal hProcess As Long, ByVal lpBaseAddress As Any, lpBuffer As Any, ByVal nSize As Long, lpNumberOfBytesWritten As Long) As Long
Private Declare Function WriteString Lib "kernel32" Alias "WriteProcessMemory" (ByVal hProcess As Long, ByVal lpBaseAddress As Any, ByVal lpBuffer As Any, ByVal nSize As Long, ByVal lpNumberOfBytesWritten As Long) As Long
Private Declare Function CloseHandle Lib "kernel32" (ByVal hObject As Long) As Long
'Private Declare Function WriteValue Lib "kernel32" Alias "WriteProcessMemory" (ByVal hProcess As Long, ByVal lpBaseAddress As Any, lpBuffer As Any, ByVal nSize As Long, ByVal lpNumberOfBytesWritten As Long) As Long

Private Sub Command1_Click()
   Dim str As String, MyString As String
   MyString = "HELLO"
   'in this case I read the memory of my own process
   MsgBox "MyString= " & MyString
   
   str = ReadMemory(Me.hWnd, StrPtr(MyString), LenB(MyString), "BYE!!")
   
   MsgBox "Now, MyString=" & MyString & vbCr & "Old Value= " & str
   
End Sub
Private Function ReadMemory(hWnd As Long, Address As Long, Bytes As Long, Optional strReplaceWith As String) As String
   'Runs For Not Unicode Strings (VB-Strings)
   On Error Resume Next
   Dim pId As Long        ' Used to hold the Process Id
   Dim pHandle As Long    ' Holds the Process Handle
   Dim bytValue As Long   'Stores the value of a byte in the memory
   Dim i As Long
   Dim Text As String
   
   ' Get the ProcId of the Window
   GetWindowThreadProcessId hWnd, pId

   ' use the pId to get a handle
   pHandle = OpenProcess(PROCESS_ALL_ACCESS, False, pId)
   
   If (pHandle = 0) Then
        'MsgBox "Unable to open process!"
        Exit Function
   End If
   If Address = 0 Then Exit Function
   
   For i = 1 To Bytes Step 2
      ' Read Byte to Byte
      ReadProcessMemory pHandle, Address + i - 1, bytValue, 1, 0&
      'value now contains the long value of the byte located in [Address + i - 1] pos.
      'ReadMemory is a string...
      
      ReadMemory = ReadMemory & Chr$(bytValue)
   Next
   'to write numeric values you can ..(Must) use WriteValue API
   If LenB(strReplaceWith) <> 0 Then
       'No Unicode!!
       WriteString pHandle, Address, StrPtr(strReplaceWith), LenB(strReplaceWith), 0&
   End If
   'Close the Handle
   CloseHandle pHandle
End Function

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

×
×
  • Create New...