Can I read memory with autoitscript?

[goldenix]

So I searched around & found nothing. I do remember seeing some code related to this, but I cant find anything anymore.

Basically I have some javascript counting down in firefox, so I found the adress 07453E0C. How can I check when the countdown will reach zero or some nr close to zero?

Edited April 18, 2010 by goldenix

[AdmiralAlkex]

Wouldn't it be better to use the IE.au3 or FF.au3 (search for it)? Otherwise I guess you want nomadmemory.au3

[goldenix]

Wouldn't it be better to use the IE.au3 or FF.au3 (search for it)? Otherwise I guess you want nomadmemory.au3

I always waned to do the memory thing. But hire is the question. if I open new tab. Then I cant really scan memory for the countdown can I? the adress will always change & so will the pointers & offset & etc right?

I found some code hire, but there are no usage examples. can you make a sample? that lets me scan for a value located hire: 1852D60C

expandcollapse popup

$test = _MemoryModuleGetBaseAddress('firefox.exe', 'ebp*4-14')

ConsoleWrite($test & @CRLF)

Func _MemoryModuleGetBaseAddress($iPID, $sModule)
    If Not ProcessExists($iPID) Then Return SetError(1, 0, 0)

    If Not IsString($sModule) Then Return SetError(2, 0, 0)

    Local   $PSAPI = DllOpen("psapi.dll")

    ;Get Process Handle
    Local   $hProcess
    Local   $PERMISSION = BitOR(0x0002, 0x0400, 0x0008, 0x0010, 0x0020) ; CREATE_THREAD, QUERY_INFORMATION, VM_OPERATION, VM_READ, VM_WRITE

    If $iPID > 0 Then
        Local $hProcess = DllCall("kernel32.dll", "ptr", "OpenProcess", "dword", $PERMISSION, "int", 0, "dword", $iPID)
        If $hProcess[0] Then
            $hProcess = $hProcess[0]
        EndIf
    EndIf

    ;EnumProcessModules
    Local   $Modules = DllStructCreate("ptr[1024]")
    Local   $aCall = DllCall($PSAPI, "int", "EnumProcessModules", "ptr", $hProcess, "ptr", DllStructGetPtr($Modules), "dword", DllStructGetSize($Modules), "dword*", 0)
    If $aCall[4] > 0 Then
        Local   $iModnum = $aCall[4] / 4
        Local   $aTemp
        For $i = 1 To $iModnum
            $aTemp =  DllCall($PSAPI, "dword", "GetModuleBaseNameW", "ptr", $hProcess, "ptr", Ptr(DllStructGetData($Modules, 1, $i)), "wstr", "", "dword", 260)
            If $aTemp[3] = $sModule Then
                DllClose($PSAPI)
                Return Ptr(DllStructGetData($Modules, 1, $i))
            EndIf
        Next
    EndIf

    DllClose($PSAPI)
    Return SetError(-1, 0, 0)

EndFunc

Edited April 18, 2010 by goldenix

[darkjohn20]

Here you go.

EDIT: Oops, didn't see that last post.

NomadMemory.au3

Edited April 18, 2010 by darkjohn20

[AdmiralAlkex]

can you make a sample?

Nah, I don't know anything about that stuff, except for which UDF to use

[goldenix]

I was thinking, if I open always different tab, then I can never find the value i need. So wouldn't it be simpler to just scan all addresses used by Firefox & search for smaller value than 999 first time & then for decreasing value until I have only 1 address left & then keep scanning this address.

This should be more simple than screwing around with the offsets right?

How can you scan all addresses?

EDIT: I found the NomadMemory.au3 & this is what I got so far, it works & returns the value I need. but, the question is, how many addresses are being used by firefox? (Edit: 155+ million). The adress is changing, I will need to scan all addresses.

How to find out the list of addresses being used by firefox?

#include <NomadMemory.au3>
#include <array.au3>

$iv_Pid = ProcessExists ( "firefox.exe" )
$_MemoryOpen = _MemoryOpen($iv_Pid)
$Mem_Read    = _MemoryRead('0x08D19A0C', $_MemoryOpen)

ConsoleWrite($Mem_Read & @CRLF)

_MemoryClose($_MemoryOpen)

Edited April 19, 2010 by goldenix