0

I modified the function processPatternScan of Kalamity/classMemory to Scan memory regions AllocationProtect is PAGE_NOACCESS

CE

    processPatternScanModified(startAddress := 0, endAddress := "", aAOBPattern*)
    {
        address := startAddress
        if endAddress is not integer 
            endAddress := this.isTarget64bit ? (A_PtrSize = 8 ? 0x7FFFFFFFFFF : 0xFFFFFFFF) : 0x7FFFFFFF

        MEM_COMMIT := 0x1000, MEM_MAPPED := 0x40000, MEM_PRIVATE := 0x20000
        PAGE_NOACCESS := 0x01, PAGE_GUARD := 0x100, PAGE_READWRITE := 0x04
        if !patternSize := this.getNeedleFromAOBPattern(patternMask, AOBBuffer, aAOBPattern*)
            return -10 
        while address <= endAddress ; > 0x7FFFFFFF - definitely reached the end of the useful area (at least for a 32 target process)
        {
            if !this.VirtualQueryEx(address, aInfo)
                return -1
            if A_Index = 1
                aInfo.RegionSize -= address - aInfo.BaseAddress

            oldProtect := aInfo.Protect
            if (aInfo.State = MEM_COMMIT) {
                If ((aInfo.Protect & (PAGE_NOACCESS | PAGE_GUARD))){
                    ; if the page is not readable, make it readable
                    dllcall("VirtualProtectEx", "ptr", this.hProcess, "ptr", address, "ptr", aInfo.RegionSize, "uint", PAGE_READWRITE, "uint*", oldProtect, "int")
                }
            }

            if (aInfo.State = MEM_COMMIT) 
                    && aInfo.RegionSize >= patternSize
                    && (result := this.PatternScan(address, aInfo.RegionSize, patternMask, AOBBuffer))
            {

                If ((aInfo.Protect & (PAGE_NOACCESS | PAGE_GUARD))){
                    ; restore the old protection
                    dllcall("VirtualProtectEx", "ptr", this.hProcess, "ptr", address, "ptr", aInfo.RegionSize, "uint", oldProtect, "uint*", 0, "int")
                }
                if result < 0 
                    return -2
                else if (result + patternSize - 1 <= endAddress)
                    return result
                else return 0
            }
            If ((aInfo.Protect & (PAGE_NOACCESS | PAGE_GUARD))){
                ; restore the old protection
                dllcall("VirtualProtectEx", "ptr", this.hProcess, "ptr", address, "ptr", aInfo.RegionSize, "uint", oldProtect, "uint*", 0, "int")
            }
            address += aInfo.RegionSize
        }
        return 0
    }

but it's not working, i don't know why, can anyone help me to make it work.

I tried using VirtualProtectEx function, but something is wrong

0 Answers0