C++ Memory Scanner

Durum
Üzgünüz bu konu cevaplar için kapatılmıştır...
Banlı Üye
Katılım
7 Ağu 2016
Mesajlar
763
Tepki puanı
2
Yaş
32
9 HİZMET YILI
PHP:
bool Functions::OpenMyProcess(DWORD pID){
   pHandle = OpenProcess(PROCESS_VM_OPERATION | PROCESS_VM_READ | PROCESS_VM_WRITE | PROCESS_QUERY_INFORMATION, FALSE, pID); //PROCESS_VM_OPERATION | PROCESS_VM_READ | PROCESS_VM_WRITE | PROCESS_QUERY_INFORMATION
   if (pHandle == INVALID_HANDLE_VALUE) {     
       MessageBox(NULL, "Can't Open Process.\n Run As Admin.", "FV2", MB_OK | MB_ICONERROR);      
       return false;      
   }
    
   if (runThread){    
       threadScan = CreateThread(NULL, 0, (LPTHREAD_START_ROUTINE)ScanMemmory, NULL, 0, &threadId);               
   }  

   return true;
}

void ScanMemmory(){

   SYSTEM_INFO sysInfo = { 0 };
   GetSystemInfo(&sysInfo);

   auto aStart = (long)sysInfo.lpMinimumApplicationAddress;
   auto aEnd = (long)sysInfo.lpMaximumApplicationAddress;

   int found = 0;

   do{

       while (aStart < aEnd){
           MEMORY_BASIC_INFORMATION mbi = { 0 };
           if (!VirtualQueryEx(Funcs.pHandle, (LPCVOID)aStart, &mbi, sizeof(mbi))){
                
               CloseHandle(Funcs.pHandle);
               TerminateThread(Funcs.threadScan, 1);          
           }

           if (mbi.State == MEM_COMMIT && ((mbi.Protect & PAGE_GUARD) == 0) && ((mbi.Protect == PAGE_NOACCESS) == 0)){

               auto isWritable = ((mbi.Protect & PAGE_READWRITE) != 0 || (mbi.Protect & PAGE_WRITECOPY) != 0 || (mbi.Protect & PAGE_EXECUTE_READWRITE) != 0 || (mbi.Protect & PAGE_EXECUTE_WRITECOPY) != 0);
               if (isWritable){

                   auto dump = new unsigned char[mbi.RegionSize + 1];
                   memset(dump, 0x00, mbi.RegionSize + 1);
                   ReadProcessMemory(Funcs.pHandle, mbi.BaseAddress, dump, mbi.RegionSize, NULL);             
                   for (auto x = 0; x < mbi.RegionSize - 4; x += 4){

                       /* FREE */
                        
                       if (free){
                           if (*(DWORD*)(dump + x) == 45000){
                               found++;
                                
                               BYTE data[] = { 0x0, 0x0, 0x0, 0x0 }; //0
                               DWORD wAddr = (DWORD)mbi.BaseAddress + x;
                                
                               WriteProcessMemory(Funcs.pHandle, (BYTE*)wAddr, &data, sizeof(data), NULL);
                                
                           }
                       }                                          

                   }
                   delete[] dump;
               }

           }
           aStart += mbi.RegionSize;
       }
       Funcs.runThread = false;

   } while (Funcs.runThread);

   if (!Funcs.runThread){     
       CloseHandle(Funcs.pHandle);        
       TerminateThread(Funcs.threadScan, 0);      
   }  
}
 
Durum
Üzgünüz bu konu cevaplar için kapatılmıştır...
Üst