I try to find byte value and address in a proccess but i thin it display in offset, i'm not sure. however, i want to retreive hex.Code:Const PROCESS_ALL_ACCESS = &H1F0FFF Dim si As SYSTEM_INFO Dim mbi As MEMORY_BASIC_INFORMATION Dim lpMem As Long, Ret As Long, lLenMBI As Long Dim CalcAddress As Long, hProcess As Long, pid As Long Dim lWritten As Long Dim window As Long window = FindWindow("class_name", vbNullString) If window = 0 Then Exit Sub Call GetWindowThreadProcessId(window, pid) hProcess = OpenProcess(PROCESS_ALL_ACCESS, False, pid) lLenMBI = Len(mbi) 'Determine applications memory addresses range Call GetSystemInfo(si) lpMem = si.lpMinimumApplicationAddress 'Scan memory Dim buffer() As Byte Do While lpMem < si.lpMaximumApplicationAddress mbi.RegionSize = 0 Ret = VirtualQueryEx(hProcess, ByVal lpMem, mbi, lLenMBI) If Ret = lLenMBI Then If ((mbi.lType = MEM_PRIVATE) And (mbi.State = MEM_COMMIT)) Then ' this block is In use by this process If mbi.RegionSize > 0 Then 'Buffer = mbi.RegionSize ReDim buffer(mbi.RegionSize) 'Read buffer ReadProcessMemory hProcess, ByVal mbi.BaseAddress, ByVal buffer(0), mbi.RegionSize, lWritten 'Check if value is found Debug.Print Hex(mbi.BaseAddress) End If End If 'Increase base address for next searching cicle. Last address may overhead max Long value (Windows use 2GB memory, which is near max long value), so add Error checking On Error GoTo Finished lpMem = mbi.BaseAddress + mbi.RegionSize On Error GoTo 0 Else Exit Do End If Loop Finished: CloseHandle hProcess




Reply With Quote