homersux
December 17th, 2004, 18:51
I am trying to write a subroutine to search for string literals in a remote process. I am pretty sure the wheel is available and I don't think my version is working that well. SO I'd appreciate if you could comment/modify/advice for code improvement, thanks a lot! I have a small tool that's about to finish with this function added. I'll release it asap afterwards.
BOOL searchProcMemory(HANDLE hp, DWORD addr, DWORD dwBytes, LPBYTE sStr,
BOOL literal, HWND listresult){
PBYTE data = 0;
BOOL retval = FALSE;
DWORD dwRead = 0, i, j;
MEMORY_BASIC_INFORMATION mbi;
LPBYTE lp = 0;
BYTE buffer[512];
DWORD found = 0, alen = strlen(sStr);
SendMessage(listresult, LB_RESETCONTENT, 0, 0);
__try{
while(VirtualQueryEx(hp, lp, &mbi, sizeof(MEMORY_BASIC_INFORMATION)) == sizeof(mbi)){
if(!mbi.State&MEM_COMMIT || mbi.Protect&PAGE_NOACCESS
|| (DWORD)mbi.AllocationBase >= 0x70000000){
lp += mbi.RegionSize;
continue;
}
data = malloc(mbi.RegionSize);
if(data == 0){
ListBox_AddString(listresult, "Reading data from remote process failed, cannot allocate"
;
__leave;
}
retval = ReadProcessMemory(hp, (PDWORD)mbi.BaseAddress, (LPVOID)data,
mbi.RegionSize, &dwRead);
if(retval == FALSE || dwRead != mbi.RegionSize){
sprintf(buffer, "%08X %08X %08X %08X %08X", mbi.AllocationBase, mbi.BaseAddress, mbi.RegionSize, dwRead, data);
ListBox_AddString(listresult, buffer);
ListBox_AddString(listresult, "Reading data from remote process failed, cannot read"
;
//__leave;
}else{
for(i = 0; i < mbi.RegionSize; i ++){
if(strncmp(data+i, sStr, alen) == 0){
found ++;
if(found < 100){
sprintf(buffer, "0x%08X - %s", (LPBYTE)mbi.AllocationBase+i, sStr);
ListBox_AddString(listresult, buffer);
}else
ListBox_AddString(listresult, "Too many found matches, skipping.."
;
}
}
}
free(data);
lp += mbi.RegionSize;
}
retval = TRUE;
}
__finally{
if(data) free(data);
}
return retval;
}
BOOL searchProcMemory(HANDLE hp, DWORD addr, DWORD dwBytes, LPBYTE sStr,
BOOL literal, HWND listresult){
PBYTE data = 0;
BOOL retval = FALSE;
DWORD dwRead = 0, i, j;
MEMORY_BASIC_INFORMATION mbi;
LPBYTE lp = 0;
BYTE buffer[512];
DWORD found = 0, alen = strlen(sStr);
SendMessage(listresult, LB_RESETCONTENT, 0, 0);
__try{
while(VirtualQueryEx(hp, lp, &mbi, sizeof(MEMORY_BASIC_INFORMATION)) == sizeof(mbi)){
if(!mbi.State&MEM_COMMIT || mbi.Protect&PAGE_NOACCESS
|| (DWORD)mbi.AllocationBase >= 0x70000000){
lp += mbi.RegionSize;
continue;
}
data = malloc(mbi.RegionSize);
if(data == 0){
ListBox_AddString(listresult, "Reading data from remote process failed, cannot allocate"

__leave;
}
retval = ReadProcessMemory(hp, (PDWORD)mbi.BaseAddress, (LPVOID)data,
mbi.RegionSize, &dwRead);
if(retval == FALSE || dwRead != mbi.RegionSize){
sprintf(buffer, "%08X %08X %08X %08X %08X", mbi.AllocationBase, mbi.BaseAddress, mbi.RegionSize, dwRead, data);
ListBox_AddString(listresult, buffer);
ListBox_AddString(listresult, "Reading data from remote process failed, cannot read"

//__leave;
}else{
for(i = 0; i < mbi.RegionSize; i ++){
if(strncmp(data+i, sStr, alen) == 0){
found ++;
if(found < 100){
sprintf(buffer, "0x%08X - %s", (LPBYTE)mbi.AllocationBase+i, sStr);
ListBox_AddString(listresult, buffer);
}else
ListBox_AddString(listresult, "Too many found matches, skipping.."

}
}
}
free(data);
lp += mbi.RegionSize;
}
retval = TRUE;
}
__finally{
if(data) free(data);
}
return retval;
}