Thread: scan for ints in a process

Threaded View

Previous Post Previous Post   Next Post Next Post
  1. #1
    Registered User
    Join Date
    Nov 2002
    Posts
    319

    scan for ints in a process

    basically what i want todo is scan this process for all the ints with the value 5, i am close to getting it working but i think something is missing , can anyone take alook at my code , thanks

    Code:
    #include <windows.h>
    #include <TlHelp32.h>
    #include <stdio.h>
    
    
    int main()
    {
    	
      HANDLE ThisProc = OpenProcess(PROCESS_ALL_ACCESS,true,GetCurrentProcessId()); //
      MEMORY_BASIC_INFORMATION mbi;
      
     
     
        char Buffer[64];
        DWORD Written;
    	SYSTEM_INFO si; 
        GetSystemInfo(&si);
        DWORD dwStart = 0;
        SIZE_T v;
        char *p;
        DWORD lpRead;
    const char* regionp;
      //BYTE s = 't';
      char *memchrp;
      int memcmpr;
      HANDLE Term;
    
      
    
      int five = 5;
    char findme[sizeof(five)]; //4
       //search for int with the value 5
       memcpy(findme, &five, sizeof(five));
    
     while(dwStart < (DWORD)si.lpMaximumApplicationAddress)
      {
    			
    	   
    
         v = VirtualQueryEx(ThisProc,
                     (void *)dwStart,
                                &mbi,
    sizeof(MEMORY_BASIC_INFORMATION));
    
    	 if(v == 0)
    	 {
    		printf("%s\n","breaking");
    		break;
    	 }
    	 
    
    	 if(mbi.State == MEM_COMMIT)
    	 {
    	     //printf("%s\n","mem_commit");
    		 p = (char *)malloc(mbi.RegionSize);
    		 
    		
    	
    
    		 printf("Memory at %02x, size %d\n",
                      mbi.BaseAddress,
                       mbi.RegionSize);
    
    		 
                
    		 if(ReadProcessMemory(ThisProc,(void *)dwStart,p,mbi.RegionSize,&lpRead))
             {
    			 	
    				const char* offset = p;
    				regionp = p;
    				while ((offset = (const char*)memchr(offset, findme[0], regionp+mbi.RegionSize-offset)) != 0)
    				{
    					   if (memcmp(offset, findme, 7) == 0) 
    					   { 						                                                          printf("%p %p\n",findme,five);
    					       Sleep(50);
    						   break;
    					   }
    					   
    					   ++offset;
    				}
    		 }
    	 }
    
    	 if(dwStart + mbi.RegionSize < dwStart)
    	 {
    		printf("%s\n","breaking");
    		 break;
    	 }
    	    
    	 if(mbi.RegionSize != lpRead)
         {
        //     printf("Not enough bytes read %d != %d\n",mbi.RegionSize,lpRead);
        }
            
    	 dwStart += mbi.RegionSize;
    
    	
    
    	Sleep(5);
    
      }
    
    
    	return 0;
    }
    Last edited by Anddos; 06-13-2012 at 07:49 AM.

Popular pages Recent additions subscribe to a feed

Similar Threads

  1. how to scan a var in enum
    By med linux in forum C Programming
    Replies: 17
    Last Post: 03-24-2011, 04:26 PM
  2. how to get process info ( to extract process thread id )
    By umen242 in forum C++ Programming
    Replies: 4
    Last Post: 02-12-2009, 01:08 PM
  3. Process sending file descriptors to another process
    By Yasir_Malik in forum C Programming
    Replies: 4
    Last Post: 04-07-2005, 07:36 PM
  4. while (scan != 'y' or 'n) or if(scan != 'y' or 'n)
    By Blizzarddog in forum C++ Programming
    Replies: 6
    Last Post: 10-23-2002, 01:16 PM
  5. Child Process & Parent Process Data :: Win32
    By kuphryn in forum Windows Programming
    Replies: 5
    Last Post: 09-11-2002, 12:19 PM