Internal full memory AoB scan

I did some quick googling and couldn't find any AoB scan snippets that would scan the entire memory space of a process, instead of just a module's memory space. Generally this will only be useful if you're hooking games that use "Just In Time Compilation" such as Java, Flash, etc.

Code:

#include <Windows.h>
#include <vector>

bool ComparePattern(DWORD address, DWORD patternAddress, char * mask) {
	int patternLen = strlen(mask);

	for (auto i = 1; i < patternLen; i++) {
		if (mask[i] != *"?" && *(char*)(address + i) != *(char*)(patternAddress + i)) {  // Compare each byte of the pattern with each byte after the current scanning address
			return false;
		}
	}
	if (address != patternAddress) {  // Make sure we aren't returning a match for the pattern defined within your DLLMain
		return true;
	}
	return false;
}

DWORD FindPattern(DWORD patternAddress, char * mask) {
	SYSTEM_INFO sysInfo; // Holds System Information
	GetSystemInfo(&sysInfo);
	DWORD procMin = (DWORD)sysInfo.lpMinimumApplicationAddress;  // Minimum memory address of process
	DWORD procMax = (DWORD)sysInfo.lpMaximumApplicationAddress;  // Maximum memory address of process

	MEMORY_BASIC_INFORMATION mBI, mBINext;

	DWORD firstOldProtect = NULL;
	DWORD secondOldProtect = NULL;

	DWORD patternSize = (DWORD)strlen(mask);

	std::vector<DWORD> matches;  // Holds all pattern matches

	while (procMin < procMax) {  // While still scanning memory

		VirtualQueryEx(GetCurrentProcess(), (LPVOID)procMin, &mBI, sizeof(MEMORY_BASIC_INFORMATION));  // Get memory page details

		if ((mBI.State == MEM_COMMIT) && (mBI.Type == MEM_PRIVATE)) {  // Check state of current page

			VirtualProtect((LPVOID)procMin, mBI.RegionSize, PAGE_EXECUTE_READWRITE, &firstOldProtect);  // Set page to read/write/execute

			for (auto n = (DWORD)mBI.BaseAddress; n < (DWORD)mBI.BaseAddress + mBI.RegionSize; n += 0x01) {  // For each byte in this page

				if (n + patternSize > procMax) {  // If our pattern will extend past the maximum memory address, break
					break;
				}

				if (*(char*)n ==(*(char*)patternAddress)) {  // If first byte of pattern matches current byte
				
					if (n + patternSize < (UINT)mBI.BaseAddress + mBI.RegionSize) {  // If entire length of pattern is within this page

						if (ComparePattern((DWORD)n, patternAddress, mask)) {  // Test if full pattern matches
							matches.push_back((DWORD)n);  // If it does, add it to the vector
						}
					}
					else {  // If it isn't within the same page
						VirtualQueryEx(GetCurrentProcess(), (LPVOID)(procMin + mBI.RegionSize), &mBINext, sizeof(MEMORY_BASIC_INFORMATION));  // Same memory page stuff with next page

						if ((mBINext.State == MEM_COMMIT) && (mBINext.Type == MEM_PRIVATE)) {
							VirtualProtect((LPVOID)(procMin + mBI.RegionSize), mBINext.RegionSize, PAGE_EXECUTE_READWRITE, &secondOldProtect);
							
							if (ComparePattern((DWORD)n, patternAddress, mask)) {
								matches.push_back((DWORD)n);

							}
						}

					}

				}
			}

			
			VirtualProtect((LPVOID)procMin, mBI.RegionSize, firstOldProtect, NULL);  // Reset memory page state of first page

			if (secondOldProtect) {  // If we scanned into the second page
				VirtualProtect((LPVOID)procMin, mBINext.RegionSize, secondOldProtect, NULL);  // Reset memory page state of second page
				secondOldProtect = NULL;
			}
		}
		procMin += mBI.RegionSize;  // Start scanning next page
	}


	if (!matches.empty()) {
		return matches[0];  // If we had some matches, return the first. -- Change this and return type of functon if you need full list of matches
	}
	else {
		return NULL;  // Return NULL if no matches
	}
}

An example of a call from within your DLL would look like:

Code:

	char playerLocBytes[] = "\xF3\x0F\x7E\x48\x00\x8B\xB8";
	char playerLocMask[] = "xxxx?xx";

	playerLocAddress = FindPattern((DWORD)&playerLocBytes ,playerLocMask);

I'm far from a professional programmer, so if I'm missing something, or doing something wrong please let me know.

It's actually not guaranteed that the process virtual memory space is continuous. Therefore, it's better to enumerate all the modules and scan all the module memory spaces. Each module has an address and size, and the kernel tends to load them in continuous memory, but it was never guaranteed. It has been a while since I last worked on the Win32 api, but in addition to tlhelp32 there was some other way to enumerate the process modules also. Tlhelp would be the easier way still.

EDIT: While it's true that you check if the page has been commit, it's still faster to just enumerate all process modules than try all the pages between lowest and highest memory address.

Originally Posted by PraiseCthulhu

It's actually not guaranteed that the process virtual memory space is continuous. Therefore, it's better to enumerate all the modules and scan all the module memory spaces. Each module has an address and size, and the kernel tends to load them in continuous memory, but it was never guaranteed. It has been a while since I last worked on the Win32 api, but in addition to tlhelp32 there was some other way to enumerate the process modules also. Tlhelp would be the easier way still.

EDIT: While it's true that you check if the page has been commit, it's still faster to just enumerate all process modules than try all the pages between lowest and highest memory address.

Just in time compilation doesn't guarantee that it will be within any modules memory space. You can check out ROTMG as an example, that's what I had to write this for.

I tried scanning through all modules memory space previous to writing this, but couldn't find any matches.

Well scan both the module + heap list then

"Traversing the Heap List" in MSDN.

But yes, it might just be _simpler_ to skip uncommitted pages when you have to add more and more types of pages.

EDIT:
I did a quick test recap and it seems like the heap enumeration is working like I remember it was. It's returning ridiculously small chunks of heap, so you could optimize using some kind of integer interval merge. Anyways, I don't know if this is still enough for your use case.

aob.h

Code:

#ifndef _AOB_H
#define _AOB_H
#define WIN32_LEAN_AND_MEAN
#include <Windows.h>
#include <TlHelp32.h>
#include <cstring>
#include <vector>


template <typename T>
class Entry {
public:
	Entry();
	Entry(Entry<T> const& rhs);

	operator T*();
	T& operator *();
	T* operator ->();

private:
	T m_buffer;
};

template <typename T>
Entry<T>::Entry() {
	std::memset(&m_buffer, 0, sizeof(T));
	m_buffer.dwSize = sizeof(T);
}

template <typename T>
Entry<T>::Entry(Entry<T> const& rhs) {
	std::memcpy(&m_buffer, &rhs.m_buffer, sizeof(T));
}

template <typename T>
Entry<T>::operator T*() {
	return &m_buffer;
}

template <typename T>
T& Entry<T>::operator *() {
	return m_buffer;
}

template <typename T>
T* Entry<T>::operator ->() {
	return &m_buffer;
}


class Snapshot {
public:
	Snapshot(DWORD process_id);
	~Snapshot();

	std::vector< Entry<THREADENTRY32> > get_threads() const;
	std::vector< Entry<MODULEENTRY32W> > get_modules() const;
	std::vector< Entry<HEAPENTRY32> > get_heaps() const;

private:
	HANDLE m_snapshot;
        DWORD m_process_id;
	DWORD m_error;
};


#endif /* AOB_H */

aob.cpp

Code:

#include <iostream>
#include "aob.h"

Snapshot::Snapshot(DWORD process_id) : m_process_id(process_id), m_error(0) {
	m_snapshot = CreateToolhelp32Snapshot(TH32CS_SNAPALL, process_id);
	if (m_snapshot == INVALID_HANDLE_VALUE) {
		m_error = GetLastError();
	}
}

Snapshot::~Snapshot() {
	if (m_snapshot != INVALID_HANDLE_VALUE) {
		CloseHandle(m_snapshot);
	}
}


std::vector< Entry<THREADENTRY32> > Snapshot::get_threads() const {
	std::vector< Entry<THREADENTRY32> > result;
	if (m_error) {
		std::cerr << "CreateToolhelp32Snapshot() failed: " << m_error << std::endl;
		return result;
	}

	Entry<THREADENTRY32> thread;
	if (!Thread32First(m_snapshot, thread)) {
		std::cerr << "Thread32First() failed: " << GetLastError() << std::endl;
		return result;
	}

        if (thread->th32OwnerProcessID == m_process_id) {
                result.push_back(thread);
        }
	while (Thread32Next(m_snapshot, thread)) {
                if (thread->th32OwnerProcessID == m_process_id) {
                        result.push_back(thread);
                }
	}
	return result;
}

std::vector< Entry<MODULEENTRY32W> > Snapshot::get_modules() const {
	std::vector< Entry<MODULEENTRY32W> > result;
	if (m_error) {
		std::cerr << "CreateToolhelp32Snapshot() failed: " << m_error << std::endl;
		return result;
	}

	Entry<MODULEENTRY32W> module;
	if (!Module32FirstW(m_snapshot, module)) {
		std::cerr << "Module32FirstW() failed: " << GetLastError() << std::endl;
		return result;
	}

        if (module->th32ProcessID == m_process_id) {
                result.push_back(module);
        }
	while (Module32NextW(m_snapshot, module)) {
                if (module->th32ProcessID == m_process_id) {
                        result.push_back(module);
                }
	}
	return result;
}

std::vector< Entry<HEAPENTRY32> > Snapshot::get_heaps() const {
	std::vector< Entry<HEAPENTRY32> > result;
	if (m_error) {
		std::cerr << "CreateToolhelp32Snapshot() failed: " << m_error << std::endl;
		return result;
	}

	Entry<HEAPLIST32> heap_list;
	if (!Heap32ListFirst(m_snapshot, heap_list)) {
		std::cerr << "Module32First() failed: " << GetLastError() << std::endl;
		return result;
	}

	do {
		Entry<HEAPENTRY32> heap;
                if (heap_list->th32ProcessID != m_process_id) {
                        // Skip this heap, we are not interested.
                        continue;
                }
		if (!Heap32First(heap, heap_list->th32ProcessID, heap_list->th32HeapID)) {
			std::cerr << "Heap32First failed for process[id=" << heap_list->th32ProcessID
					  << "] heap[id=" << heap_list->th32HeapID << "]" << std::endl;
                        continue;
		}
                result.push_back(heap);
                while (Heap32Next(heap)) {
                        result.push_back(heap);
                }
	}
	while (Heap32ListNext(m_snapshot, heap_list));

	return result;
}

main.cpp, this was written rather quickly just to proof of concept the enumeration.

Code:

#include <iostream>
#include <iomanip>
#include "aob.h"

constexpr std::streamsize HEXW = sizeof(std::uintptr_t) * 2;


void thread_print(THREADENTRY32 const& thread) {
    std::cout << "  ThreadID: " << thread.th32ThreadID << std::endl;
}

void module_print(MODULEENTRY32W const& module) {
    std::wcout << L"  Name: " << module.szModule << std::endl
               << L"  Path: " << module.szExePath << std::endl
               << L"  Memory Range: "
               << std::setfill(L'0') << std::setw(HEXW) << std::setbase(16) << module.modBaseAddr
               << L" -> "
               << std::setfill(L'0') << std::setw(HEXW) << std::setbase(16) << (module.modBaseAddr + module.modBaseSize)
               << std::endl << std::endl;
}

void heap_print(HEAPENTRY32 const& heap) {
    std::cout << "  Memory Range: "
              << std::setfill('0') << std::setw(HEXW) << std::setbase(16) << heap.dwAddress
              << " -> "
              << std::setfill('0') << std::setw(HEXW) << std::setbase(16) << (heap.dwAddress + heap.dwBlockSize)
              << std::endl;
}


void print_all() {
    Snapshot snapshot(GetCurrentProcessId());
    std::cout << "THREADS" << std::endl;
    for (auto entry : snapshot.get_threads()) {
        thread_print(*entry);
    }
    std::cout << "MODULES" << std::endl;
    for (auto entry : snapshot.get_modules()) {
        module_print(*entry);
    }
    std::cout << "HEAPS" << std::endl;
    for (auto entry : snapshot.get_heaps()) {
        heap_print(*entry);
    }
}


int main(void) {
    std::cout << "Begin enumerating" << std::endl;
    print_all();
    std::cout << "Finished" << std::endl;
    return 0;
}

Also, it prints nicely on both X86 and X86_64 builds:

Code:

Begin enumerating
THREADS
  ThreadID: 9420
  ThreadID: 11944
  ThreadID: 10408
  ThreadID: 8804
MODULES
  Name: aobscan.exe
  Path: {CENSORED}\aobscan\Debug\aobscan.exe
  Memory Range: 00210000 -> 00245000

  Name: ntdll.dll
  Path: C:\WINDOWS\SYSTEM32\ntdll.dll
  Memory Range: 77380000 -> 77503000

  Name: KERNEL32.DLL
  Path: C:\WINDOWS\System32\KERNEL32.DLL
  Memory Range: 76310000 -> 763F0000

  Name: KERNELBASE.dll
  Path: C:\WINDOWS\System32\KERNELBASE.dll
  Memory Range: 76C30000 -> 76DD1000

  Name: MSVCP140D.dll
  Path: C:\WINDOWS\SYSTEM32\MSVCP140D.dll
  Memory Range: 0F800000 -> 0F8B9000

  Name: VCRUNTIME140D.dll
  Path: C:\WINDOWS\SYSTEM32\VCRUNTIME140D.dll
  Memory Range: 0F7C0000 -> 0F7DC000

  Name: ucrtbased.dll
  Path: C:\WINDOWS\SYSTEM32\ucrtbased.dll
  Memory Range: 0FEF0000 -> 10066000

HEAPS
  Memory Range: 00c70008 -> 00c700b8
  Memory Range: 00c700b8 -> 00c700f0
  Memory Range: 00c700f0 -> 00c70110
  Memory Range: 00c70110 -> 00c70130
  Memory Range: 00c70130 -> 00c70200
  Memory Range: 00c70200 -> 00c70330
  Memory Range: 00c70330 -> 00c70458
  Memory Range: 00c70458 -> 00c70488
  Memory Range: 00c70488 -> 00c70498
  Memory Range: 00c70498 -> 00c704b0
  Memory Range: 00c704b0 -> 00c72400
  Memory Range: 00c72400 -> 00c74a18
  Memory Range: 00c74a18 -> 00c74a60
  Memory Range: 00c74a60 -> 00c74a98
  Memory Range: 00c74a98 -> 00c74b08
  Memory Range: 00c74b08 -> 00c74bb8
  Memory Range: 00c74bb8 -> 00c74bf0
  Memory Range: 00c74bf0 -> 00c74ca0
  Memory Range: 00c74ca0 -> 00c74cd8
  Memory Range: 00c74cd8 -> 00c74f00
  Memory Range: 00c74f00 -> 00c74f80
  Memory Range: 00c74f80 -> 00c75030
  Memory Range: 00c75030 -> 00c75068
  Memory Range: 00c75068 -> 00c750b8
  Memory Range: 00c750b8 -> 00c75150
  Memory Range: 00c75150 -> 00c75168
  Memory Range: 00c75168 -> 00c751a0
  Memory Range: 00c751a0 -> 00c751b8
  Memory Range: 00c751b8 -> 00c751d0
  Memory Range: 00c751d0 -> 00c75200
  Memory Range: 00c75200 -> 00c75218
  Memory Range: 00c75218 -> 00c75230
  Memory Range: 00c75230 -> 00c75250
  Memory Range: 00c75250 -> 00c75300
  Memory Range: 00c75300 -> 00c75338
  Memory Range: 00c75338 -> 00c75388
  Memory Range: 00c75388 -> 00c75398
  Memory Range: 00c75398 -> 00c753f8
  Memory Range: 00c753f8 -> 00c75600
  Memory Range: 00c75600 -> 00c75808
  Memory Range: 00c75808 -> 00c75838
  Memory Range: 00c75838 -> 00c75868
  Memory Range: 00c75868 -> 00c758b0
  Memory Range: 00c758b0 -> 00c75980
  Memory Range: 00c75980 -> 00c75aa8
  Memory Range: 00c75aa8 -> 00c75b30
  Memory Range: 00c75b30 -> 00c75be0
  Memory Range: 00c75be0 -> 00c75c20
  Memory Range: 00c75c20 -> 00c75ca0
  Memory Range: 00c75ca0 -> 00c75d50
  Memory Range: 00c75d50 -> 00c75f28
  Memory Range: 00c75f28 -> 00c75f78
  Memory Range: 00c75f78 -> 00c75fc8
  Memory Range: 00c75fc8 -> 00c76018
  Memory Range: 00c76018 -> 00c76068
  Memory Range: 00c76068 -> 00c760b8
  Memory Range: 00c760b8 -> 00c76108
  Memory Range: 00c76108 -> 00c76158
  Memory Range: 00c76158 -> 00c761a8
  Memory Range: 00c761a8 -> 00c761f8
  Memory Range: 00c761f8 -> 00c76248
  Memory Range: 00c76248 -> 00c76298
  Memory Range: 00c76298 -> 00c762e8
  Memory Range: 00c762e8 -> 00c76338
  Memory Range: 00c76338 -> 00c76388
  Memory Range: 00c76388 -> 00c763d8
  Memory Range: 00c763d8 -> 00c76428
  Memory Range: 00c76428 -> 00c76478
  Memory Range: 00c76478 -> 00c764c8
  Memory Range: 00c764c8 -> 00c76518
  Memory Range: 00c76518 -> 00c76568
  Memory Range: 00c76568 -> 00c765b8
  Memory Range: 00c765b8 -> 00c76608
  Memory Range: 00c76608 -> 00c76658
  Memory Range: 00c76658 -> 00c766a8
  Memory Range: 00c766a8 -> 00c766f8
  Memory Range: 00c766f8 -> 00c76760
  Memory Range: 00c76760 -> 00c76778
  Memory Range: 00c76778 -> 00c76888
  Memory Range: 00c76888 -> 00c768c0
  Memory Range: 00c768c0 -> 00c775a8
  Memory Range: 00c775a8 -> 00c77600
  Memory Range: 00c77600 -> 00c77620
  Memory Range: 00c77620 -> 00c77640
  Memory Range: 00c77640 -> 00c77660
  Memory Range: 00c77660 -> 00c776c8
  Memory Range: 00c776c8 -> 00c77718
  Memory Range: 00c77718 -> 00c77738
  Memory Range: 00c77738 -> 00c77910
  Memory Range: 00c77910 -> 00c77928
  Memory Range: 00c77928 -> 00c77958
  Memory Range: 00c77958 -> 00c77988
  Memory Range: 00c77988 -> 00c77998
  Memory Range: 00c77998 -> 00c779d0
  Memory Range: 00c779d0 -> 00c77a38
  Memory Range: 00c77a38 -> 00c77c10
  Memory Range: 00c77c10 -> 00c77e20
  Memory Range: 00c77e20 -> 00c78228
  Memory Range: 00c78228 -> 00c78920
  Memory Range: 00c78920 -> 00c79550
  Memory Range: 00c79550 -> 00c797a0
  Memory Range: 00c797a0 -> 00c799f0
  Memory Range: 00c799f0 -> 00c79ff0
  Memory Range: 00c79ff0 -> 00c7a048
  Memory Range: 00c7a048 -> 00c7a1c8
  Memory Range: 00c7a1c8 -> 00c7a2a0
  Memory Range: 00c7a2a0 -> 00c7a2e0
  Memory Range: 00c7a2e0 -> 00c7a320
  Memory Range: 00c7a320 -> 00c7a368
  Memory Range: 00c7a368 -> 00c7a3c0
  Memory Range: 00c7a3c0 -> 00c7a418
  Memory Range: 00c7a418 -> 00c7a460
  Memory Range: 00c7a460 -> 00c7a4b8
  Memory Range: 00c7a4b8 -> 00c7a4f8
  Memory Range: 00c7a4f8 -> 00c7a540
  Memory Range: 00c7a540 -> 00c7a588
  Memory Range: 00c7a588 -> 00c7a608
  Memory Range: 00c7a608 -> 00c7a688
  Memory Range: 00c7a688 -> 00c7a708
  Memory Range: 00c7a708 -> 00c7a740
  Memory Range: 00c7a740 -> 00c7a7b8
  Memory Range: 00c7a7b8 -> 00c7a7f8
  Memory Range: 00c7a7f8 -> 00c7a850
  Memory Range: 00c7a850 -> 00c7a890
  Memory Range: 00c7a890 -> 00c7a8d0
  Memory Range: 00c7a8d0 -> 00c7b100
  Memory Range: 00c7b100 -> 00c7b1b0
  Memory Range: 00c7b1b0 -> 00c7b1e8
  Memory Range: 00c7b1e8 -> 00c7b218
  Memory Range: 00c7b218 -> 00c7b250
  Memory Range: 00c7b250 -> 00c7b298
  Memory Range: 00c7b298 -> 00c7b2d0
  Memory Range: 00c7b2d0 -> 00c7b340
  Memory Range: 00c7b340 -> 00c7b450
  Memory Range: 00c7b450 -> 00c7b488
  Memory Range: 00c7b488 -> 00c7b4c0
  Memory Range: 00c7b4c0 -> 00c7b500
  Memory Range: 00c7b500 -> 00c7b730
  Memory Range: 00c7b730 -> 00c7b7a0
  Memory Range: 00c7b7a0 -> 00c7b7e8
  Memory Range: 00c7b7e8 -> 00c7b818
  Memory Range: 00c7b818 -> 00c7b850
  Memory Range: 00c7b850 -> 00c7b888
  Memory Range: 00c7b888 -> 00c7b8c0
  Memory Range: 00c7b8c0 -> 00c7b8f8
  Memory Range: 00c7b8f8 -> 00c7b930
  Memory Range: 00c7b930 -> 00c7b968
  Memory Range: 00c7b968 -> 00c7b9a0
  Memory Range: 00c7b9a0 -> 00c7b9d8
  Memory Range: 00c7b9d8 -> 00c7ba10
  Memory Range: 00c7ba10 -> 00c7ba48
  Memory Range: 00c7ba48 -> 00c7ba80
  Memory Range: 00c7ba80 -> 00c7bab8
  Memory Range: 00c7bab8 -> 00c7baf0
  Memory Range: 00c7baf0 -> 00c7bb28
  Memory Range: 00c7bb28 -> 00c7bb60
  Memory Range: 00c7bb60 -> 00c7bb98
  Memory Range: 00c7bb98 -> 00c7bbd0
  Memory Range: 00c7bbd0 -> 00c7be00
  Memory Range: 00c7be00 -> 00c7bea0
  Memory Range: 00c7bea0 -> 00c7bee8
  Memory Range: 00c7bee8 -> 00c7c118
  Memory Range: 00c7c118 -> 00c7c200
  Memory Range: 00c7c200 -> 00c7c330
  Memory Range: 00c7c330 -> 00c7c778
  Memory Range: 00c7c778 -> 00c7c8c0
  Memory Range: 00c7c8c0 -> 00c7c918
  Memory Range: 00c7c918 -> 00c7c980
  Memory Range: 00c7c980 -> 00c7c9e8
  Memory Range: 00c7c9e8 -> 00c7ca50
  Memory Range: 00c7ca50 -> 00c7cab8
  Memory Range: 00c7cab8 -> 00c7cb20
  Memory Range: 00c7cb20 -> 00c7cb88
  Memory Range: 00c7cb88 -> 00c7cbf0
  Memory Range: 00c7cbf0 -> 00c7cc58
  Memory Range: 00c7cc58 -> 00c7ccc0
  Memory Range: 00c7ccc0 -> 00c7cd28
  Memory Range: 00c7cd28 -> 00c7cd90
  Memory Range: 00c7cd90 -> 00c7cdf8
  Memory Range: 00c7cdf8 -> 00c7ce60
  Memory Range: 00c7ce60 -> 00c7cec8
  Memory Range: 00c7cec8 -> 00c7cf30
  Memory Range: 00c7cf30 -> 00c7cf98
  Memory Range: 00c7cf98 -> 00c7d000
  Memory Range: 00c7d000 -> 00c7d068
  Memory Range: 00c7d068 -> 00c7d0d0
  Memory Range: 00c7d0d0 -> 00c7d130
  Memory Range: 00c7d130 -> 00c7d188
  Memory Range: 00c7d188 -> 00c7d1e8
  Memory Range: 00c7d1e8 -> 00c7d240
  Memory Range: 00c7d240 -> 00c7d2a0
  Memory Range: 00c7d2a0 -> 00c7d2e0
  Memory Range: 00c7d2e0 -> 00c7d328
  Memory Range: 00c7d328 -> 00c7d380
  Memory Range: 00c7d380 -> 00c7d3d8
  Memory Range: 00c7d3d8 -> 00c7d420
  Memory Range: 00c7d420 -> 00c7d460
  Memory Range: 00c7d460 -> 00c7d4d8
  Memory Range: 00c7d4d8 -> 00c7d570
  Memory Range: 00c7d570 -> 00c7d5b8
  Memory Range: 00c7d5b8 -> 00c7d630
  Memory Range: 00c7d630 -> 00c7d670
  Memory Range: 00c7d670 -> 00c7d6b8
  Memory Range: 00c7d6b8 -> 00c7d700
  Memory Range: 00c7d700 -> 00c7d748
  Memory Range: 00c7d748 -> 00c7d780
  Memory Range: 00c7d780 -> 00c7d7b8
  Memory Range: 00c7d7b8 -> 00c7d7f0
  Memory Range: 00c7d7f0 -> 00c7d828
  Memory Range: 00c7d828 -> 00c7d860
  Memory Range: 00c7d860 -> 00c7d898
  Memory Range: 00c7d898 -> 00c7d8d0
  Memory Range: 00c7d8d0 -> 00c7d908
  Memory Range: 00c7d908 -> 00c7d940
  Memory Range: 00c7d940 -> 00c7d978
  Memory Range: 00c7d978 -> 00c7d9b0
  Memory Range: 00c7d9b0 -> 00c7d9e8
  Memory Range: 00c7d9e8 -> 00c7da20
  Memory Range: 00c7da20 -> 00c7da58
  Memory Range: 00c7da58 -> 00c7da90
  Memory Range: 00c7da90 -> 00c7dac8
  Memory Range: 00c7dac8 -> 00c7db00
  Memory Range: 00c7db00 -> 00c7db38
  Memory Range: 00c7db38 -> 00c7db70
  Memory Range: 00c7db70 -> 00c7dba8
  Memory Range: 00c7dba8 -> 00c7dbe0
  Memory Range: 00c7dbe0 -> 00c7dc18
  Memory Range: 00c7dc18 -> 00c7dc50
  Memory Range: 00c7dc50 -> 00c7dc88
  Memory Range: 00c7dc88 -> 00c7dcc0
  Memory Range: 00c7dcc0 -> 00c7dcf8
  Memory Range: 00c7dcf8 -> 00c7dd30
  Memory Range: 00c7dd30 -> 00c7dd68
  Memory Range: 00c7dd68 -> 00c7dda0
  Memory Range: 00c7dda0 -> 00c7ddd8
  Memory Range: 00c7ddd8 -> 00c7de10
  Memory Range: 00c7de10 -> 00c7de48
  Memory Range: 00c7de48 -> 00c7de80
  Memory Range: 00c7de80 -> 00c7deb8
  Memory Range: 00c7deb8 -> 00c7def0
  Memory Range: 00c7def0 -> 00c80bb8
  Memory Range: 00c80bb8 -> 00c846e8
  Memory Range: 00c846e8 -> 00d6b6e8
Finished

Code:

Begin enumerating
THREADS
  ThreadID: 7592
  ThreadID: 5044
  ThreadID: 4864
  ThreadID: 7948
MODULES
  Name: aobscan.exe
  Path: {CENSORED}\aobscan\x64\Debug\aobscan.exe
  Memory Range: 00007FF65B720000 -> 00007FF65B762000

  Name: ntdll.dll
  Path: C:\WINDOWS\SYSTEM32\ntdll.dll
  Memory Range: 00007FFBC97A0000 -> 00007FFBC9971000

  Name: KERNEL32.DLL
  Path: C:\WINDOWS\System32\KERNEL32.DLL
  Memory Range: 00007FFBC6D30000 -> 00007FFBC6DDB000

  Name: KERNELBASE.dll
  Path: C:\WINDOWS\System32\KERNELBASE.dll
  Memory Range: 00007FFBC6A10000 -> 00007FFBC6C2D000

  Name: MSVCP140D.dll
  Path: C:\WINDOWS\SYSTEM32\MSVCP140D.dll
  Memory Range: 00007FFBAC180000 -> 00007FFBAC276000

  Name: ucrtbased.dll
  Path: C:\WINDOWS\SYSTEM32\ucrtbased.dll
  Memory Range: 00007FFBA9FE0000 -> 00007FFBAA19E000

  Name: VCRUNTIME140D.dll
  Path: C:\WINDOWS\SYSTEM32\VCRUNTIME140D.dll
  Memory Range: 00007FFBBE200000 -> 00007FFBBE222000

HEAPS
  Memory Range: 00000152a7df0010 -> 00000152a7df0080
  Memory Range: 00000152a7df0080 -> 00000152a7df00e0
  Memory Range: 00000152a7df00e0 -> 00000152a7df0120
  Memory Range: 00000152a7df0120 -> 00000152a7df0150
  Memory Range: 00000152a7df0150 -> 00000152a7df0260
  Memory Range: 00000152a7df0260 -> 00000152a7df0440
  Memory Range: 00000152a7df0440 -> 00000152a7df0620
  Memory Range: 00000152a7df0620 -> 00000152a7df0670
  Memory Range: 00000152a7df0670 -> 00000152a7df0690
  Memory Range: 00000152a7df0690 -> 00000152a7df06b0
  Memory Range: 00000152a7df06b0 -> 00000152a7df25f0
  Memory Range: 00000152a7df25f0 -> 00000152a7df2e50
  Memory Range: 00000152a7df2e50 -> 00000152a7df2ea0
  Memory Range: 00000152a7df2ea0 -> 00000152a7df2ee0
  Memory Range: 00000152a7df2ee0 -> 00000152a7df2f50
  Memory Range: 00000152a7df2f50 -> 00000152a7df3080
  Memory Range: 00000152a7df3080 -> 00000152a7df30e0
  Memory Range: 00000152a7df30e0 -> 00000152a7df3210
  Memory Range: 00000152a7df3210 -> 00000152a7df3270
  Memory Range: 00000152a7df3270 -> 00000152a7df34b0
  Memory Range: 00000152a7df34b0 -> 00000152a7df3570
  Memory Range: 00000152a7df3570 -> 00000152a7df36a0
  Memory Range: 00000152a7df36a0 -> 00000152a7df3700
  Memory Range: 00000152a7df3700 -> 00000152a7df3750
  Memory Range: 00000152a7df3750 -> 00000152a7df3930
  Memory Range: 00000152a7df3930 -> 00000152a7df3950
  Memory Range: 00000152a7df3950 -> 00000152a7df3980
  Memory Range: 00000152a7df3980 -> 00000152a7df39d0
  Memory Range: 00000152a7df39d0 -> 00000152a7df3a00
  Memory Range: 00000152a7df3a00 -> 00000152a7df3a40
  Memory Range: 00000152a7df3a40 -> 00000152a7df3b70
  Memory Range: 00000152a7df3b70 -> 00000152a7df3bd0
  Memory Range: 00000152a7df3bd0 -> 00000152a7df3c20
  Memory Range: 00000152a7df3c20 -> 00000152a7df3c40
  Memory Range: 00000152a7df3c40 -> 00000152a7df3c90
  Memory Range: 00000152a7df3c90 -> 00000152a7df3d00
  Memory Range: 00000152a7df3d00 -> 00000152a7df4110
  Memory Range: 00000152a7df4110 -> 00000152a7df4520
  Memory Range: 00000152a7df4520 -> 00000152a7df4580
  Memory Range: 00000152a7df4580 -> 00000152a7df45e0
  Memory Range: 00000152a7df45e0 -> 00000152a7df4650
  Memory Range: 00000152a7df4650 -> 00000152a7df4760
  Memory Range: 00000152a7df4760 -> 00000152a7df4860
  Memory Range: 00000152a7df4860 -> 00000152a7df4990
  Memory Range: 00000152a7df4990 -> 00000152a7df49f0
  Memory Range: 00000152a7df49f0 -> 00000152a7df4a20
  Memory Range: 00000152a7df4a20 -> 00000152a7df4af0
  Memory Range: 00000152a7df4af0 -> 00000152a7df4c20
  Memory Range: 00000152a7df4c20 -> 00000152a7df4c80
  Memory Range: 00000152a7df4c80 -> 00000152a7df4cb0
  Memory Range: 00000152a7df4cb0 -> 00000152a7df4d70
  Memory Range: 00000152a7df4d70 -> 00000152a7df4ea0
  Memory Range: 00000152a7df4ea0 -> 00000152a7df4f00
  Memory Range: 00000152a7df4f00 -> 00000152a7df4f30
  Memory Range: 00000152a7df4f30 -> 00000152a7df4fc0
  Memory Range: 00000152a7df4fc0 -> 00000152a7df5360
  Memory Range: 00000152a7df5360 -> 00000152a7df53b0
  Memory Range: 00000152a7df53b0 -> 00000152a7df53e0
  Memory Range: 00000152a7df53e0 -> 00000152a7df5420
  Memory Range: 00000152a7df5420 -> 00000152a7df5470
  Memory Range: 00000152a7df5470 -> 00000152a7df54e0
  Memory Range: 00000152a7df54e0 -> 00000152a7df5520
  Memory Range: 00000152a7df5520 -> 00000152a7df5560
  Memory Range: 00000152a7df5560 -> 00000152a7df55b0
  Memory Range: 00000152a7df55b0 -> 00000152a7df55e0
  Memory Range: 00000152a7df55e0 -> 00000152a7df5670
  Memory Range: 00000152a7df5670 -> 00000152a7df5a10
  Memory Range: 00000152a7df5a10 -> 00000152a7df5a60
  Memory Range: 00000152a7df5a60 -> 00000152a7df5a90
  Memory Range: 00000152a7df5a90 -> 00000152a7df5b00
  Memory Range: 00000152a7df5b00 -> 00000152a7df5b80
  Memory Range: 00000152a7df5b80 -> 00000152a7df5ba0
  Memory Range: 00000152a7df5ba0 -> 00000152a7df5bd0
  Memory Range: 00000152a7df5bd0 -> 00000152a7df5c60
  Memory Range: 00000152a7df5c60 -> 00000152a7df5ed0
  Memory Range: 00000152a7df5ed0 -> 00000152a7df5f20
  Memory Range: 00000152a7df5f20 -> 00000152a7df6c40
  Memory Range: 00000152a7df6c40 -> 00000152a7df6fe0
  Memory Range: 00000152a7df6fe0 -> 00000152a7df7400
  Memory Range: 00000152a7df7400 -> 00000152a7df7c10
  Memory Range: 00000152a7df7c10 -> 00000152a7df83e0
  Memory Range: 00000152a7df83e0 -> 00000152a7df9420
  Memory Range: 00000152a7df9420 -> 00000152a7df9690
  Memory Range: 00000152a7df9690 -> 00000152a7df9700
  Memory Range: 00000152a7df9700 -> 00000152a7df9760
  Memory Range: 00000152a7df9760 -> 00000152a7df97c0
  Memory Range: 00000152a7df97c0 -> 00000152a7df9820
  Memory Range: 00000152a7df9820 -> 00000152a7df9890
  Memory Range: 00000152a7df9890 -> 00000152a7df9900
  Memory Range: 00000152a7df9900 -> 00000152a7df9970
  Memory Range: 00000152a7df9970 -> 00000152a7df99e0
  Memory Range: 00000152a7df99e0 -> 00000152a7df9a40
  Memory Range: 00000152a7df9a40 -> 00000152a7df9ab0
  Memory Range: 00000152a7df9ab0 -> 00000152a7df9b10
  Memory Range: 00000152a7df9b10 -> 00000152a7dfa130
  Memory Range: 00000152a7dfa130 -> 00000152a7dfa190
  Memory Range: 00000152a7dfa190 -> 00000152a7dfa1f0
  Memory Range: 00000152a7dfa1f0 -> 00000152a7dfa250
  Memory Range: 00000152a7dfa250 -> 00000152a7dfa2b0
  Memory Range: 00000152a7dfa2b0 -> 00000152a7dfa310
  Memory Range: 00000152a7dfa310 -> 00000152a7dfa370
  Memory Range: 00000152a7dfa370 -> 00000152a7dfa3d0
  Memory Range: 00000152a7dfa3d0 -> 00000152a7dfa430
  Memory Range: 00000152a7dfa430 -> 00000152a7dfa490
  Memory Range: 00000152a7dfa490 -> 00000152a7dfa4f0
  Memory Range: 00000152a7dfa4f0 -> 00000152a7dfa550
  Memory Range: 00000152a7dfa550 -> 00000152a7dfa5b0
  Memory Range: 00000152a7dfa5b0 -> 00000152a7dfa610
  Memory Range: 00000152a7dfa610 -> 00000152a7dfa670
  Memory Range: 00000152a7dfa670 -> 00000152a7dfa6d0
  Memory Range: 00000152a7dfa6d0 -> 00000152a7dfa730
  Memory Range: 00000152a7dfa730 -> 00000152a7dfa790
  Memory Range: 00000152a7dfa790 -> 00000152a7dfa7f0
  Memory Range: 00000152a7dfa7f0 -> 00000152a7dfa850
  Memory Range: 00000152a7dfa850 -> 00000152a7dfa8b0
  Memory Range: 00000152a7dfa8b0 -> 00000152a7dfa900
  Memory Range: 00000152a7dfa900 -> 00000152a7dfaa40
  Memory Range: 00000152a7dfaa40 -> 00000152a7dfaac0
  Memory Range: 00000152a7dfaac0 -> 00000152a7dfab30
  Memory Range: 00000152a7dfab30 -> 00000152a7dfabd0
  Memory Range: 00000152a7dfabd0 -> 00000152a7dfad70
  Memory Range: 00000152a7dfad70 -> 00000152a7dfae10
  Memory Range: 00000152a7dfae10 -> 00000152a7dfaef0
  Memory Range: 00000152a7dfaef0 -> 00000152a7dfb130
  Memory Range: 00000152a7dfb130 -> 00000152a7dfb2d0
  Memory Range: 00000152a7dfb2d0 -> 00000152a7dfb510
  Memory Range: 00000152a7dfb510 -> 00000152a7dfb750
  Memory Range: 00000152a7dfb750 -> 00000152a7dfb910
  Memory Range: 00000152a7dfb910 -> 00000152a7dfbb10
  Memory Range: 00000152a7dfbb10 -> 00000152a7dfbb70
  Memory Range: 00000152a7dfbb70 -> 00000152a7dfbbe0
  Memory Range: 00000152a7dfbbe0 -> 00000152a7dfbc30
  Memory Range: 00000152a7dfbc30 -> 00000152a7dfbcc0
  Memory Range: 00000152a7dfbcc0 -> 00000152a7dfbd70
  Memory Range: 00000152a7dfbd70 -> 00000152a7dfbe00
  Memory Range: 00000152a7dfbe00 -> 00000152a7dfbe70
  Memory Range: 00000152a7dfbe70 -> 00000152a7dfc000
  Memory Range: 00000152a7dfc000 -> 00000152a7dfc0f0
  Memory Range: 00000152a7dfc0f0 -> 00000152a7dfc140
  Memory Range: 00000152a7dfc140 -> 00000152a7dfc190
  Memory Range: 00000152a7dfc190 -> 00000152a7dfc200
  Memory Range: 00000152a7dfc200 -> 00000152a7dfc270
  Memory Range: 00000152a7dfc270 -> 00000152a7dfc2e0
  Memory Range: 00000152a7dfc2e0 -> 00000152a7dfc330
  Memory Range: 00000152a7dfc330 -> 00000152a7dfc3b0
  Memory Range: 00000152a7dfc3b0 -> 00000152a7dfc430
  Memory Range: 00000152a7dfc430 -> 00000152a7dfc4c0
  Memory Range: 00000152a7dfc4c0 -> 00000152a7dfc550
  Memory Range: 00000152a7dfc550 -> 00000152a7dfc5e0
  Memory Range: 00000152a7dfc5e0 -> 00000152a7dfc630
  Memory Range: 00000152a7dfc630 -> 00000152a7dfc680
  Memory Range: 00000152a7dfc680 -> 00000152a7dfc710
  Memory Range: 00000152a7dfc710 -> 00000152a7dfc760
  Memory Range: 00000152a7dfc760 -> 00000152a7dfc7d0
  Memory Range: 00000152a7dfc7d0 -> 00000152a7dfc820
  Memory Range: 00000152a7dfc820 -> 00000152a7dfc870
  Memory Range: 00000152a7dfc870 -> 00000152a7dfc8c0
  Memory Range: 00000152a7dfc8c0 -> 00000152a7dfc910
  Memory Range: 00000152a7dfc910 -> 00000152a7dfc960
  Memory Range: 00000152a7dfc960 -> 00000152a7dfc9b0
  Memory Range: 00000152a7dfc9b0 -> 00000152a7dfca00
  Memory Range: 00000152a7dfca00 -> 00000152a7dfca50
  Memory Range: 00000152a7dfca50 -> 00000152a7dfcaa0
  Memory Range: 00000152a7dfcaa0 -> 00000152a7dfcaf0
  Memory Range: 00000152a7dfcaf0 -> 00000152a7dfcb40
  Memory Range: 00000152a7dfcb40 -> 00000152a7dfcb90
  Memory Range: 00000152a7dfcb90 -> 00000152a7dfcbe0
  Memory Range: 00000152a7dfcbe0 -> 00000152a7dfcc30
  Memory Range: 00000152a7dfcc30 -> 00000152a7dfcc80
  Memory Range: 00000152a7dfcc80 -> 00000152a7dfccd0
  Memory Range: 00000152a7dfccd0 -> 00000152a7dfcd20
  Memory Range: 00000152a7dfcd20 -> 00000152a7dfcd70
  Memory Range: 00000152a7dfcd70 -> 00000152a7dfcdc0
  Memory Range: 00000152a7dfcdc0 -> 00000152a7dfce10
  Memory Range: 00000152a7dfce10 -> 00000152a7dfce60
  Memory Range: 00000152a7dfce60 -> 00000152a7dfceb0
  Memory Range: 00000152a7dfceb0 -> 00000152a7dfcf00
  Memory Range: 00000152a7dfcf00 -> 00000152a7dfcf50
  Memory Range: 00000152a7dfcf50 -> 00000152a7dfdf90
  Memory Range: 00000152a7dfdf90 -> 00000152a7dfdfe0
  Memory Range: 00000152a7dfdfe0 -> 00000152a7dfe030
  Memory Range: 00000152a7dfe030 -> 00000152a7dfe080
  Memory Range: 00000152a7dfe080 -> 00000152a7dfe0d0
  Memory Range: 00000152a7dfe0d0 -> 00000152a7dfe120
  Memory Range: 00000152a7dfe120 -> 00000152a7dfe170
  Memory Range: 00000152a7dfe170 -> 00000152a7dfe1c0
  Memory Range: 00000152a7dfe1c0 -> 00000152a7dfe210
  Memory Range: 00000152a7dfe210 -> 00000152a7dfe260
  Memory Range: 00000152a7dfe260 -> 00000152a7dfe2b0
  Memory Range: 00000152a7dfe2b0 -> 00000152a7dfe300
  Memory Range: 00000152a7dfe300 -> 00000152a7dfe350
  Memory Range: 00000152a7dfe350 -> 00000152a7dfe3a0
  Memory Range: 00000152a7dfe3a0 -> 00000152a7dfe3f0
  Memory Range: 00000152a7dfe3f0 -> 00000152a7dfe440
  Memory Range: 00000152a7dfe440 -> 00000152a7dfe490
  Memory Range: 00000152a7dfe490 -> 00000152a7dfe4e0
  Memory Range: 00000152a7dfe4e0 -> 00000152a7dfe530
  Memory Range: 00000152a7dfe530 -> 00000152a7dfe580
  Memory Range: 00000152a7dfe580 -> 00000152a7dfe5d0
  Memory Range: 00000152a7dfe5d0 -> 00000152a7dfe620
  Memory Range: 00000152a7dfe620 -> 00000152a7dfe670
  Memory Range: 00000152a7dfe670 -> 00000152a7dfe6c0
  Memory Range: 00000152a7dfe6c0 -> 00000152a7dfe710
  Memory Range: 00000152a7dfe710 -> 00000152a7dfe760
  Memory Range: 00000152a7dfe760 -> 00000152a7dfe7b0
  Memory Range: 00000152a7dfe7b0 -> 00000152a7dfe800
  Memory Range: 00000152a7dfe800 -> 00000152a7dfe850
  Memory Range: 00000152a7dfe850 -> 00000152a7dfe8a0
  Memory Range: 00000152a7dfe8a0 -> 00000152a7dfe8f0
  Memory Range: 00000152a7dfe8f0 -> 00000152a7dfe940
  Memory Range: 00000152a7dfe940 -> 00000152a7dfe990
  Memory Range: 00000152a7dfe990 -> 00000152a7dfe9e0
  Memory Range: 00000152a7dfe9e0 -> 00000152a7dfea30
  Memory Range: 00000152a7dfea30 -> 00000152a7dfea80
  Memory Range: 00000152a7dfea80 -> 00000152a7dfead0
  Memory Range: 00000152a7dfead0 -> 00000152a7dfeb20
  Memory Range: 00000152a7dfeb20 -> 00000152a7dfeb70
  Memory Range: 00000152a7dfeb70 -> 00000152a7dfebc0
  Memory Range: 00000152a7dfebc0 -> 00000152a7dfec10
  Memory Range: 00000152a7dfec10 -> 00000152a7dfec60
  Memory Range: 00000152a7dfec60 -> 00000152a7dfecb0
  Memory Range: 00000152a7dfecb0 -> 00000152a7dfed00
  Memory Range: 00000152a7dfed00 -> 00000152a7dfed50
  Memory Range: 00000152a7dfed50 -> 00000152a7dfeda0
  Memory Range: 00000152a7dfeda0 -> 00000152a7dfedf0
  Memory Range: 00000152a7dfedf0 -> 00000152a7dfee40
  Memory Range: 00000152a7dfee40 -> 00000152a7dfee90
  Memory Range: 00000152a7dfee90 -> 00000152a7dfeee0
  Memory Range: 00000152a7dfeee0 -> 00000152a7dfef30
  Memory Range: 00000152a7dfef30 -> 00000152a7dff170
  Memory Range: 00000152a7dff170 -> 00000152a7dff5f0
  Memory Range: 00000152a7dff5f0 -> 00000152a7dff660
  Memory Range: 00000152a7dff660 -> 00000152a7dff6d0
  Memory Range: 00000152a7dff6d0 -> 00000152a7dff740
  Memory Range: 00000152a7dff740 -> 00000152a7dff7b0
  Memory Range: 00000152a7dff7b0 -> 00000152a7dff820
  Memory Range: 00000152a7dff820 -> 00000152a7dff890
  Memory Range: 00000152a7dff890 -> 00000152a7dff900
  Memory Range: 00000152a7dff900 -> 00000152a7dff970
  Memory Range: 00000152a7dff970 -> 00000152a7dff9e0
  Memory Range: 00000152a7dff9e0 -> 00000152a7dffa50
  Memory Range: 00000152a7dffa50 -> 00000152a7dffac0
  Memory Range: 00000152a7dffac0 -> 00000152a7dffb30
  Memory Range: 00000152a7dffb30 -> 00000152a7dffba0
  Memory Range: 00000152a7dffba0 -> 00000152a7dffc10
  Memory Range: 00000152a7dffc10 -> 00000152a7dffc80
  Memory Range: 00000152a7dffc80 -> 00000152a7dffcf0
  Memory Range: 00000152a7dffcf0 -> 00000152a7dffd60
  Memory Range: 00000152a7dffd60 -> 00000152a7e042f0
  Memory Range: 00000152a7e042f0 -> 00000152a7e08dc0
  Memory Range: 00000152a7e08dc0 -> 00000152a7eebdc0
  Memory Range: 00000152a7c00010 -> 00000152a7c008b0
  Memory Range: 00000152a7c008b0 -> 00000152a7c0f8b0
Finished

Might implement an actual scanner later

Internal full memory AoB scan

Post a Reply

Similar Threads

Tags for this Thread