HelpVB 2010 - Signature / Pattern scanning

PInvokeStackImbalance was detected
Message: A call to PInvoke function 'WindowsApplication1!WindowsApplication1.Module1::ReadProcessMemory' has unbalanced the stack. This is likely because the managed PInvoke signature does not match the unmanaged target signature. Check that the calling convention and parameters of the PInvoke signature match the target unmanaged signature.

 Dim sigAddresses As Integer = AOBSCAN("ac_client", "ac_client.exe", New Byte() {&HFF, &H25, &HBC, &H30, &HF, &H1, &H75, &H2}, New Byte() {&HFF, &H0, &HFF, &H0, &HFF, &H0, &H0, &H0})
'Not an actual pattern and mask. Also, I'm currently just testing and trying to get it to work with a simple game ( Assault Cube )

    ''' <summary> Opens an existing local process object. </summary>
    ''' <param name="dwProcessId">The identifier of the local process to be opened.
    ''' If the specified process is the System Process (0x00000000), the function fails and the last error code is ERROR_INVALID_PARAMETER. If the specified process is the Idle process or one of the CSRSS processes, this function fails and the last error code is ERROR_ACCESS_DENIED because their access restrictions prevent user-level code from opening them.</param>
    ''' <param name="dwDesiredAccess">The access to the process object. This access right is checked against the security descriptor for the process. This parameter can be one or more of the process access rights.
    ''' If the caller has enabled the SeDebugPrivilege privilege, the requested access is granted regardless of the contents of the security descriptor.</param>
    ''' <param name="bInheritHandle">If this value is TRUE, processes created by this process will inherit the handle. Otherwise, the processes do not inherit this handle.</param>
    Public Declare Function OpenProcess Lib "kernel32" (ByVal dwDesiredAccess As UInteger, ByVal bInheritHandle As Boolean, ByVal dwProcessId As Integer) As IntPtr
   
    ''' <summary> Closes an open object handle.</summary>
    ''' <param name="hObject">A valid handle to an open object.</param>
    Public Declare Function CloseHandle Lib "kernel32" (ByVal hObject As IntPtr) As Boolean
 

    ''' <summary> Reads data from an area of memory in a specified process. The entire area to be read must be accessible or the operation fails.</summary>
    ''' <param name="hProcess">A handle to the process with memory that is being read. The handle must have PROCESS_VM_READ access to the process.</param>
    ''' <param name="lpBaseAddress">A pointer to the base address in the specified process from which to read. Before any data transfer occurs, the system verifies that all data in the base address and memory of the specified size is accessible for read access, and if it is not accessible the function fails.</param>
    ''' <param name="lpBuffer">A pointer to a buffer that receives the contents from the address space of the specified process.</param>
    ''' <param name="nSize">The number of bytes to be read from the specified process.</param>
    ''' <param name="lpNumberOfBytesRead">A pointer to a variable that receives the number of bytes transferred into the specified buffer. If lpNumberOfBytesRead is NULL, the parameter is ignored.</param>
    '''<remarks>WriteProcessMemory copies the data from the specified buffer in the current process to the address range of the specified process. Any process that has a handle with PROCESS_VM_WRITE and PROCESS_VM_OPERATION access to the process to be written to can call the function. Typically but not always, the process with address space that is being written to is being debugged.
    '''The entire area to be written to must be accessible, and if it is not accessible, the function fails.</remarks>
    Public Declare Function ReadProcessMemory Lib "kernel32" (ByVal hProcess As IntPtr, ByVal lpBaseAddress As UInt32, ByVal lpBuffer() As Byte, ByVal nSize As UInt32, ByRef lpNumberOfBytesRead As UIntPtr) As Boolean


    ''' <summary> Function used to read memory. </summary>
    ''' <param name="P">The process to read memory from.</param>
    ''' <param name="memAdr">The memory address that will be read.</param>
    Public Function ReadLong(ByVal P As Process, ByVal memAdr As UInt32) As Long
        Return BitConverter.ToInt64(ReadBytes(P, memAdr, 8), 0)
    End Function


    ''' <summary> Function used to read memory. </summary>
    ''' <param name="P">The process to read memory from.</param>
    ''' <param name="memAdr">The memory address that will be read.</param>
    Public Function ReadFloat(ByVal P As Process, ByVal memAdr As UInt32) As Single
        Return BitConverter.ToSingle(ReadBytes(P, memAdr, 4), 0)
    End Function


    ''' <summary> Function used to read memory. </summary>
    ''' <param name="P">The process to read memory from.</param>
    ''' <param name="memAdr">The memory address that will be read.</param>
    Public Function ReadInt32(ByVal P As Process, ByVal memAdr As UInt32) As Integer
        Return BitConverter.ToInt32(ReadBytes(P, memAdr, 4), 0)
    End Function


    ''' <summary> Function used to read memory. </summary>
    ''' <param name="P">The process to read memory from.</param>
    ''' <param name="memAdr">The memory address that will be read.</param>
    Public Function ReadShort(ByVal P As Process, ByVal memAdr As UInt32) As Short
        Return BitConverter.ToInt16(ReadBytes(P, memAdr, 2), 0)
    End Function


    ''' <summary> Function used to read memory. </summary>
    ''' <param name="P">The process to read memory from.</param>
    ''' <param name="memAdr">The memory address that will be read.</param>
    Public Function ReadByte(ByVal P As Process, ByVal memAdr As UInt32) As Byte
        Return ReadBytes(P, memAdr, 1)(0)
    End Function


    ''' <summary> Function used to read memory. </summary>
    ''' <param name="P">The process to read memory from.</param>
    ''' <param name="memAdr">The memory address that will be read.</param>
    ''' <param name="startIndex">The index of the bit to read from(0 to 7).</param>
    Public Function ReadBit(ByVal P As Process, ByVal memAdr As Int32, ByVal startIndex As Integer) As Boolean
        If (startIndex <= 7 And startIndex >= 0) Then '1 Byte == 8 Bits.  
            Return ((ReadByte(P, memAdr) And (2 ^ startIndex)) <> 0) ' 2^0 = 1(00000001), 2^1 = 2(00000010), 2^2 = 4(00000100) (...);
        End If
        Return False
    End Function


    ''' <summary> Function used to read memory. </summary>
    ''' <param name="P">The process to read memory from.</param>
    ''' <param name="memAdr">The memory address that will be read.</param>
    ''' <param name="length">The amount of bytes to read from the specified address.</param>
    Public Function ReadBytes(ByVal P As Process, ByVal memAdr As UInt32, ByVal length As UInteger) As Byte()
        Dim buffer As Byte() = New Byte(length - 1) {} 'Creates our buffer.
        Dim hProcess as IntPtr = OpenProcess(&H1F0FFF, False, P.Id) 'Creates our process handle.
        If Not ReadProcessMemory(hProcess, New IntPtr(CLng(memAdr)), buffer, length, 0) Then buffer = Nothing 'Reads the memory in that address, and writes it to the buffer. If there was an error while reading memory, then it'll return null.
        CloseHandle(hProcess) 'Closes handle to prevent errors.
        Return buffer 'Returns the buffer.
    End Function