Sign in to follow this  
Followers 0
MasterX

Another memory read thread

4 posts in this topic

Ok, i used Cheat Engine and Nomad Memory to read an adress form firefox, but all it returned was 0. So i tried it with some other adresses, they always returned 0. Then i tried it with InternetExplorer,always 0. Then i tried it with a game, 0 .

So it seems AutoIt has the problem Oo

#include<NomadMemory.au3>
$iv_Pid = "firefox.exe"
$iv_DesiredAccess =0x1F0FFF
$iv_InheritHandle = 1
$sv_Type = "dword"
$iv_Address=0x02481D60
$OpenProccess = _MemoryOpen($iv_Pid,$iv_DesiredAccess,$iv_InheritHandle)
If @error Then
    MsgBox(0,"Mem Read","openerror")
EndIf   
$Read =  _MemoryRead($iv_Address,$OpenProccess) 
If @error Then
    MsgBox(0,"_Mem Read","readerror"&@error)
EndIf
MsgBox(0,"Mem Read","Data Read: " & $Read) 
_MemoryClose($OpenProccess)

Share this post


Link to post
Share on other sites



From what i can tell your trying to pass "firefox.exe" as a Process ID where in fact you need to enter a number.

To get the PID of Firefox.exe you need to use the WinGetProcess function

#include<NomadMemory.au3>
$iv_Pid = WinGetProcess("firefox.exe")
$iv_DesiredAccess =0x1F0FFF
$iv_InheritHandle = 1
$sv_Type = "dword"
$iv_Address=0x02481D60
$OpenProccess = _MemoryOpen($iv_Pid,$iv_DesiredAccess,$iv_InheritHandle)
If @error Then
    MsgBox(0,"Mem Read","openerror")
EndIf    
$Read =  _MemoryRead($iv_Address,$OpenProccess)
If @error Then
    MsgBox(0,"_Mem Read","readerror"&@error)
EndIf
MsgBox(0,"Mem Read","Data Read: " & $Read)
_MemoryClose($OpenProccess)

Try that


Click here for the best AutoIt help possible.Currently Working on: Autoit RAT

Share this post


Link to post
Share on other sites

Thanks champ, now it works :P

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!


Register a new account

Sign in

Already have an account? Sign in here.


Sign In Now
Sign in to follow this  
Followers 0