I am trying to make a small program that will find all the int varibles loaded in the memory of my process, source code as follows
Code:
int _tmain(int argc, _TCHAR* argv[])
{
GetSystemInfo(&si);
while(dwStart < (DWORD)si.lpMaximumApplicationAddress)
{
LookForInts(dwStart);
if(dwStart + mbi.RegionSize < dwStart)
{
printf("%s\n","breaking");
break;
}
if(mbi.RegionSize != lpRead)
{
printf("Not enough bytes read %d != %d\n",mbi.RegionSize,lpRead);
}
dwStart += mbi.RegionSize;
Sleep(500);
}
return 0;
}
void LookForInts(DWORD dStart)
{
DWORD Pid;
GetWindowThreadProcessId(FindWindow(NULL,"Our Program"),&Pid);
HANDLE Process = OpenProcess(PROCESS_ALL_ACCESS ,true,Pid);
printf("%d %d\n",Pid,dStart);
v = VirtualQueryEx(Process,
(void *)dStart,
&mbi,
sizeof(MEMORY_BASIC_INFORMATION));
if(v == 0)
{
printf("%s\n","breaking");
}
else
{
if(mbi.State == MEM_COMMIT)
{
printf("%s\n","MEM_COMMIT");
if(!ReadProcessMemory(Process, //process handle
(LPVOID)&dStart, //address
(LPVOID)&mbi.RegionSize,
mbi.RegionSize,
&lpRead))
{
printf("%s\n","rpm failed");
}
else
{
printf("%s\n","rpm success");
}
}
}
}
can you tell me if i am on the right track, i want to search 4 bytes in the region and then check if the value is greater than 0, so that will say its a int beng used etc