Reading Memory

[caused]

Hey,
does simba have functions implemented for reading the Memory of a certain application ?

[Main]

I don't think so :(

[tls]

You can do it through a plugin.

[caused]

Hey,
does simba have functions implemented for reading the Memory of a certain application ?


You can do it through a plugin.

Is there a plugin out there that offers such functions ?

[Nava2]

You could implement it. Just use a PChar (I think, either way I mean a pointer to a char) and point it to a memory location.. primitve, but it will do what you want.

I think Simba can already get Process information.

[bg5]

Yes ,it would be cool to implement memory reading for Simba!


Is there a plugin out there that offers such functions ?

If someone is thinking about doing such plugin ,maybe will be interested:

http://code.google.com/p/cheat-engine/source/browse/trunk/Cheat%20Engine/memscan.pas

[caused]

You could implement it. Just use a PChar (I think, either way I mean a pointer to a char) and point it to a memory location.. primitve, but it will do what you want.

I think Simba can already get Process information.

Could you give me an example for that ?

[masterBB]

The function simba uses for getting the process information is EnumWindows. Linky Link to resources. (http://msdn.microsoft.com/en-us/library/windows/desktop/ms633497(v=vs.85).aspx)

This loops through all the windows and gets the HWND. Which can be used for stuff like this. (http://msdn.microsoft.com/en-us/library/windows/desktop/ms633530(v=vs.85).aspx)Note that this works differently in linux.

Just search through the windows api and create a plugin.

[bg5]

For reading memory in windows you would propably need
This (http://msdn.microsoft.com/en-us/library/windows/desktop/aa366907%28v=vs.85%29.aspx) and This. (http://msdn.microsoft.com/en-us/library/windows/desktop/ms680553%28v=vs.85%29.aspx)

[Brandon]

Not sure if I had to actually stdcall and extern all of these because I'm pretty sure pascal has SOME of these natively but anyway.. I can confirm that with an extension, FindWindow and SetParent works.. I haven't tested the alloc and free or any of the process functions but they should indeed work else you'd be writing a plugin instead of an extension.. short example:


function FindWindow(ClassName, WindowName: PChar): HWND; external 'FindWindowA@User32.dll stdcall';

function SetParent(Child, Parent: HWND): HWND; external 'SetParent@User32.dll stdcall';

function VirtualFreeEx(hProcess: THANDLE; lpAddress: Pointer; dwSize: LongWord; dwFreeType: LongWord): Boolean; external 'VirtualFreeEx@Kernel32.dll stdcall';

function VirtualAllocEx(hProcess: THANDLE; lpAddress: Pointer; dwSize: LongWord; flAllocationType: LongWord; flProtect: LongWord): POINTER; external 'VirtualAllocEx@Kernel32.dll stdcall';

function GetWindowThreadProcessId(WindowHandle: HWND; var dwProcessId: LongWord): LongWord; external 'GetWindowThreadProcessId@User32.dll stdcall';

function OpenProcess(dwDesiredAccess: LongWord; bInheritHandle: Boolean; dwProcessId: LongWord): THANDLE; external 'OpenProcess@Kernel32.dll stdcall';

function ReadProcessMemory(hProcess: THANDLE; lpBaseAddress: Pointer; lpBuffer: Pointer; nSize: LongInt; dwBytesRead: LongWord): Boolean; external 'ReadProcessMemory@Kernel32.dll stdcall';

//Usage:

Function ReadInject: Boolean;
var
WindowHandle: HWND; //HANDLE.
PHandle: THandle; //HANDLE.
PID, ThreadID, BytesRead: LongWord; //DWORD.
ProcessBuffer, Something: Pointer; //void* aka LPVoid.
begin
try
//Grab a handle to the desired window..
WindowHandle:= FindWindow('SunAwtFrame', 'Public SMARTv6.9 - SMART Minimizing Autoing Resource Thing - By BenLand100');

//Get PID By Window Handle..
ThreadID:= GetWindowThreadProcessID(WindowHandle, PID);

//Get OpenProcess Handle From PID..
PHandle:= OpenProcess(PROCESS_ALL_ACCESS, False, PID);
if (PHandle <> 0) then
begin
//Allocate Space for the buffer..
ProcessBuffer := VirtualAllocEx(PHandle, nil, BUFFER_SIZE, MEM_COMMIT, PAGE_READWRITE);

//Fill the buffer with some information from a window or button or whatever..
SendMessage(WindowHandle, WM_GETTEXT, WindowID, Integer(ProcessBuffer));

//Read Process Memory Address..
ReadProcessMemory(ThreadID, ProcessBuffer, Something, SizeOf(SomethingsDataType), BytesRead);

//Free Allocated Buffer Memory..
VirtualFreeEx(taskbarProcessHandle, taskbarProcessBuffer, 0, MEM_RELEASE);
end;
finally
CloseHandle(PHandle); //external 'CloseHandle@Kernel32.dll stdcall'.
end;
end;