C++ regular expression from ReadProcessMemory output

Question

I want to match some strings from notepad process memory, but i have no success. Here is the code:

int bytes_to_read = (int)info.RegionSize;
char *buffer;
buffer = (char*)malloc(bytes_to_read+1);
ReadProcessMemory(hProcess, info.BaseAddress, buffer, bytes_to_read, NULL);
const char *t1re = ";\\d{0,19}";
regex ret1(t1re);
cmatch match;

if(regex_search(buffer, match, ret1))
{
    cout << "Found: " << pe32.szExeFile << "\n";
    system("pause");
}

What are the strings you are trying to match? And which strings are actually matched? (Examples?) — Hulk, Dec 11 '13 at 16:55
for example, i type in notepad test;123456789 but the program does not match the string: ";123456789". — user3092064, Dec 11 '13 at 16:56
Did you try to debug your program, to make sure that buffer actually contained the string you expect? — Hulk, Dec 11 '13 at 17:04
i am sure that the buffer contains the string that i expect. — user3092064, Dec 11 '13 at 17:09

score 0 · Answer 1 · answered Dec 11 '13 at 17:00

0

notepad, being a Windows program, probably uses UCS-2 or I guess these days UTF-16. Which means you need a Unicode regex.

And are you sure that regex_search even works on binary data? It might exit at the first zero byte believing it is the end of string.

answered Dec 11 '13 at 17:00

Zan Lynx

53,022
10
79
131

What can i do in order to work for me? Can you give me more details, please? – user3092064 Dec 11 '13 at 17:11
@user3092064: I know that my answer is not the best because it doesn't solve anything. However, I don't have time to research it. You will need to go figure it out. – Zan Lynx Dec 11 '13 at 17:14
it works with this code, but i cannot imagine what i am doing wrong. const char *expr = ";\\d{0,19}"; regex rgx(expr); cmatch match; const char *tgt = "This is a test.23ed;1234567890fdfh0987654321?qwef32f3f"; if (regex_search(tgt, match, rgx)) cout << "Match found after"; else cout << "Not found."; system("pause"); – user3092064 Dec 11 '13 at 17:39

C++ regular expression from ReadProcessMemory output

1 Answers1