/** * Description: Reads the value located in the memory address specified. * * Parameter(s): iv_Address - The memory address you want to read from. It must be in hex * format (0x00000000). * ah_Handle - An array containing the Dll handle and the handle of the open * process as returned by _MemoryOpen(). * sv_Type - (optional) The "Type" of value you intend to read. This is set to * 'dword'(32bit(4byte) signed integer) by default. See the help file * for DllStructCreate for all types. * An example: If you want to read a word that is 15 characters in * length, you would use 'char[16]'. * Requirement(s): The ah_Handle returned from _MemoryOpen. * Return Value(s): On Success - Returns the value located at the specified address. * On Failure - Returns 0 */ public static int MemoryRead(IntPtr iv_Address, IntPtr ah_Handle, string sv_Type = "dword") { var v_Buffer = AutoItApi.DllStructCreate(sv_Type); int numberBytesRead = 0; ReadProcessMemory(ah_Handle, iv_Address, v_Buffer, AutoItApi.DllStructGetSize(v_Buffer), out numberBytesRead); var v_Value = AutoItApi.DllStructGetData(v_Buffer, 1, sv_Type); return(v_Value); }
/** * @brief Reads a chain of pointers and returns an array containing the destination * address and the data at the address. * Parameter(s): iv_Address - The static memory address you want to start at. It must be in * hex format (0x00000000). * ah_Handle - An array containing the Dll handle and the handle of the open * process as returned by _MemoryOpen(). * av_Offset - An array of offsets for the pointers. Each pointer must have an * offset. If there is no offset for a pointer, enter 0 for that * array dimension. * sv_Type - (optional) The "Type" of data you intend to read at the destination * address. This is set to 'dword'(32bit(4byte) signed integer) by * default. See the help file for DllStructCreate for all types. * Requirement(s): The ah_Handle returned from _MemoryOpen. * Return Value(s): On Success - Returns an array containing the destination address and the value * located at the address. * On Failure - Returns 0 * Note(s): Values returned are in Decimal format, unless a 'char' type is selected. * Set av_Offset like this: * av_Offset[0] = NULL (not used) * av_Offset[1] = Offset for pointer 1 (all offsets must be in Decimal) * av_Offset[2] = Offset for pointer 2 * etc... * (The number of array dimensions determines the number of pointers) */ public static IntPtr MemoryPointerRead(IntPtr iv_Address, IntPtr ah_Handle, int[] av_Offset, string sv_Type = "dword") { var iv_PointerCount = av_Offset.Length - 1; IntPtr[] iv_Data = new IntPtr[2]; var v_Buffer = AutoItApi.DllStructCreate("dword"); int numberBytesRead = 0; for (int i = 0; i <= iv_PointerCount; i++) { if (i == iv_PointerCount) { // Last Pointer v_Buffer = AutoItApi.DllStructCreate(sv_Type); iv_Address = iv_Data[1] + av_Offset[i]; ReadProcessMemory(ah_Handle, iv_Address, v_Buffer, AutoItApi.DllStructGetSize(v_Buffer), out numberBytesRead); iv_Data[1] = (IntPtr)AutoItApi.DllStructGetData(v_Buffer, 1, sv_Type); } else if (i == 0) { // First Pointer ReadProcessMemory(ah_Handle, iv_Address, v_Buffer, AutoItApi.DllStructGetSize(v_Buffer), out numberBytesRead); // Pointer always dword iv_Data[1] = (IntPtr)AutoItApi.DllStructGetData(v_Buffer, 1, "dword"); } else { iv_Address = iv_Data[1] + av_Offset[i]; ReadProcessMemory(ah_Handle, iv_Address, v_Buffer, AutoItApi.DllStructGetSize(v_Buffer), out numberBytesRead); // Pointer always dword iv_Data[1] = (IntPtr)AutoItApi.DllStructGetData(v_Buffer, 1, "dword"); } } iv_Data[0] = iv_Address; return(iv_Data[1]); }