Code:
Imports VB = Microsoft.VisualBasic
Imports System.Runtime.InteropServices
Public Class Form1
Inherits System.Windows.Forms.Form
Structure OSVERSIONINFO
Dim dwOSVersionInfoSize As Integer
Dim dwMajorVersion As Integer
Dim dwMinorVersion As Integer
Dim dwBuildNumber As Integer
Dim dwPlatformId As Integer
<VBFixedString(128)> Dim szCSDVersion As Char
End Structure
Structure MEMORY_BASIC_INFORMATION ' 28 bytes
Dim BaseAddress As Integer
Dim AllocationBase As Integer
Dim AllocationProtect As Integer
Dim RegionSize As Integer
Dim State As Integer
Dim Protect As Integer
Dim lType As Integer
End Structure
Structure SYSTEM_INFO ' 36 Bytes
Dim dwOemID As Integer
Dim dwPageSize As Integer
Dim lpMinimumApplicationAddress As Integer
Dim lpMaximumApplicationAddress As Integer
Dim dwActiveProcessorMask As Integer
Dim dwNumberOrfProcessors As Integer
Dim dwProcessorType As Integer
Dim dwAllocationGranularity As Integer
Dim wProcessorLevel As Short
Dim wProcessorRevision As Short
End Structure
Private Declare Function GetVersionEx Lib "kernel32" Alias "GetVersionExA" (ByRef LpVersionInformation As OSVERSIONINFO) As Integer
Private Declare Function VirtualQueryEx Lib "kernel32" (ByVal hProcess As IntPtr, ByVal lpAddress As UInteger, ByRef lpBuffer As MEMORY_BASIC_INFORMATION, ByVal dwLength As Integer) As Integer
'Private Declare Function VirtualQueryEx Lib "kernel32" (ByVal hProcess As Long, ByRef lpAddress As Long, ByRef lpBuffer As MEMORY_BASIC_INFORMATION, ByVal dwLength As Long) As Object
'Private Declare Function VirtualQueryEx& Lib "kernel32" (ByVal hProcess As Long, ByVal lpAddress As Long, ByVal lpBuffer As MEMORY_BASIC_INFORMATION, ByVal dwLength As Long)
Private Declare Sub GetSystemInfo Lib "kernel32" (ByRef lpSystemInfo As SYSTEM_INFO)
Private Declare Function OpenProcess Lib "kernel32" (ByVal dwDesiredAccess As Integer, ByVal blnheritHandle As Integer, ByVal dwAppProcessId As Integer) As Integer
Private Declare Function CloseHandle Lib "kernel32" (ByVal hObject As Integer) As Integer
Private Declare Function ReadProcessMemory Lib "kernel32" (ByVal hProcess As Integer, ByRef lpBaseAddress As Integer, ByRef lpBuffer As String, ByVal nSize As Integer, ByRef lpNumberOfBytesWritten As Integer) As Integer
'Private Declare Function WriteProcessMemory Lib "kernel32" (ByVal hProcess As Integer, ByRef lpBaseAddress As integer, ByRef lpBuffer As string, ByVal nSize As Integer, ByRef lpNumberOfBytesWritten As Integer) As Integer
Private Declare Function WriteProcessMemory Lib "kernel32" (ByVal hProcess As Integer, ByRef lpBaseAddress As Integer, ByRef lpBuffer As String, ByVal nSize As Integer, ByRef lpNumberOfBytesWritten As Integer) As Integer
Private Declare Function GetWindowThreadProcessId Lib "user32" (ByVal hWnd As Integer, ByRef lpdwProcessId As Integer) As Integer
Private Declare Function FindWindow Lib "user32" Alias "FindWindowA" (ByVal lpClassName As Integer, ByVal lpWindowName As Integer) As Integer
Private Declare Function GetParent Lib "user32" (ByVal hWnd As Integer) As Integer
Private Declare Function GetWindow Lib "user32" (ByVal hWnd As Integer, ByVal wCmd As Integer) As Integer
Const GW_HWNDNEXT As Short = 2
Const PROCESS_VM_READ As Short = (&H10)
Const PROCESS_VM_WRITE As Short = (&H20)
Const PROCESS_VM_OPERATION As Short = (&H8)
Const PROCESS_QUERY_INFORMATION As Short = (&H400)
Const PROCESS_READ_WRITE_QUERY As Integer = PROCESS_VM_READ + PROCESS_VM_WRITE + PROCESS_VM_OPERATION + PROCESS_QUERY_INFORMATION
Public Const PROCESS_ALL_ACCESS As Integer = &H1F0FFF
Const MEM_PRIVATE As Integer = &H20000
Const MEM_COMMIT As Short = &H1000
Private Sub Button1_Click(ByVal sender As Object, ByVal e As System.EventArgs) Handles Button1.Click
Dim pid As Integer, hProcess As Integer, hWin As Integer
Dim lpMem As Integer, ret As Integer, lLenMBI As Integer
Dim lWritten As Integer, CalcAddress As Integer, lPos As Integer
Dim sBuffer As String = ""
Dim sSearchString As String = ""
Dim si As SYSTEM_INFO
Dim mbi As MEMORY_BASIC_INFORMATION
sSearchString = "34,56,23,74,69" 'THIS IS WHAT I NEED TO FOUND
'Open process with required access
hProcess = OpenProcess(PROCESS_ALL_ACCESS, False, game_hwnd)
lLenMBI = Len(mbi)
'Determine applications memory addresses range
GetSystemInfo(si)
lpMem = si.lpMinimumApplicationAddress
'Scan memory
Do While lpMem < si.lpMaximumApplicationAddress
mbi.RegionSize = 0
ret = VirtualQueryEx(hProcess, lpMem, mbi, lLenMBI) 'HERE THE DEBUGGER STOPS WITH ERROR: "PInvoke restriction: cannot return variants."
'FROM HERE I DON'T KNOW IF THE PROGRAM WORKS
If ret = lLenMBI Then
If ((mbi.lType = MEM_PRIVATE) And (mbi.State = MEM_COMMIT)) Then ' this block is In use by this process
If mbi.RegionSize > 0 Then
sBuffer = StrDup(mbi.RegionSize, 0)
'Read region into string
ReadProcessMemory(hProcess, mbi.BaseAddress, sBuffer, mbi.RegionSize, lWritten)
'Check if region contain search string
lPos = InStr(1, sBuffer, sSearchString, CompareMethod.Text)
If lPos Then
CalcAddress = mbi.BaseAddress + lPos
ret = MsgBox("Search string was found at address " & CalcAddress)
Exit Do
End If
End If
End If
'Increase base address for next searching cicle. Last address may overhead max Long value (Windows use 2GB memory, which is near max long value), so add Error checking
On Error GoTo Finished
lpMem = mbi.BaseAddress + mbi.RegionSize
On Error GoTo 0
Else
Exit Do
End If
Loop
Finished:
CloseHandle(hProcess)
End Sub
Public Function game_hwnd() As Long
Dim procList() As Process = Process.GetProcesses()
Dim iProcID As Integer
For i As Integer = 0 To UBound(procList)
Dim strProcName As String = procList(i).ProcessName
If strProcName = "notepad" Then
iProcID = procList(i).Id
Exit For
End If
Next
Return iProcID
End Function
End Class
I took the first code the user posted, because I had no idea what he was doing in the second one.