GetAccessProtection(PID, addr) {
static PROCESS_QUERY_INFORMATION := 0x400
hProcess := DllCall("OpenProcess", UInt, PROCESS_QUERY_INFORMATION, UInt, 0, UInt, PID, Ptr)
VarSetCapacity(MEMORY_BASIC_INFORMATION, size := A_PtrSize*4 + 4*2 + A_PtrSize, 0)
if !res := DllCall("VirtualQueryEx", Ptr, hProcess, Ptr, addr, Ptr, &MEMORY_BASIC_INFORMATION, Ptr, size)
MsgBox, % "Error: " A_LastError
DllCall("CloseHandle", Ptr, hProcess)
if res
Return NumGet(MEMORY_BASIC_INFORMATION, A_PtrSize*4 + 4, "UInt")
}
Run, notepad,,, PID
WinWait, ahk_pid %PID%
RB := new RemoteBuffer(PID, 4) ; для проверки создаём буфер в адресном пространстве блокнота с правами чтения и записи
MsgBox, % Format("{:#x}", RB.ptr) ; адрес буфера
MsgBox, % GetAccessProtection(PID, RB.ptr) ; должно вернуть 4 — PAGE_READWRITE
GetAccessProtection(PID, addr) {
static PROCESS_QUERY_INFORMATION := 0x400
hProcess := DllCall("OpenProcess", UInt, PROCESS_QUERY_INFORMATION, UInt, 0, UInt, PID, Ptr)
VarSetCapacity(MEMORY_BASIC_INFORMATION, size := A_PtrSize*4 + 4*2 + A_PtrSize, 0)
if !res := DllCall("VirtualQueryEx", Ptr, hProcess, Ptr, addr, Ptr, &MEMORY_BASIC_INFORMATION, Ptr, size)
MsgBox, % "Error: " A_LastError
DllCall("CloseHandle", Ptr, hProcess)
if res
Return NumGet(MEMORY_BASIC_INFORMATION, A_PtrSize*4 + 4, "UInt")
}
class RemoteBuffer
{
__New(PID, size) {
static PROCESS_VM_OPERATION := 0x8, PROCESS_VM_WRITE := 0x20
, PROCESS_VM_READ := 0x10, MEM_COMMIT := 0x1000, PAGE_READWRITE := 0x4
if !(this.hProc := DllCall("OpenProcess", UInt, PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE, Int, 0, UInt, PID, Ptr))
Return
if !(this.ptr := DllCall("VirtualAllocEx", Ptr, this.hProc, Ptr, 0, Ptr, size, UInt, MEM_COMMIT, UInt, PAGE_READWRITE, Ptr))
Return, "", DllCall("CloseHandle", Ptr, this.hProc)
this.hHeap := DllCall("GetProcessHeap", Ptr)
}
__Delete() {
DllCall("VirtualFreeEx", Ptr, this.hProc, Ptr, this.ptr, UInt, 0, UInt, MEM_RELEASE := 0x8000)
DllCall("CloseHandle", Ptr, this.hProc)
DllCall("HeapFree", Ptr, this.hHeap, UInt, 0, Ptr, this.pHeap)
}
Read(size, offset = 0) {
(this.pHeap && DllCall("HeapFree", Ptr, this.hHeap, UInt, 0, Ptr, this.pHeap))
this.pHeap := DllCall("HeapAlloc", Ptr, this.hHeap, UInt, HEAP_ZERO_MEMORY := 0x8, Ptr, size, Ptr)
if !DllCall("ReadProcessMemory", Ptr, this.hProc, Ptr, this.ptr + offset, Ptr, this.pHeap, Ptr, size, Int, 0)
Return, 0, DllCall("MessageBox", Ptr, 0, Str, "Не удалось прочитать данные`nОшибка " A_LastError, Str, "", UInt, 0)
Return this.pHeap
}
Write(pLocalBuff, size, offset = 0) {
if !res := DllCall("WriteProcessMemory", Ptr, this.hProc, Ptr, this.ptr + offset, Ptr, pLocalBuff, Ptr, size, PtrP, writtenBytes)
DllCall("MessageBox", Ptr, 0, Str, "Не удалось записать данные`nОшибка " A_LastError, Str, "", UInt, 0)
Return writtenBytes
}
}