52 replies to this topic

[wOxxOm]

widow, this is the answer for your deleted post:

;ReplaceByte - replace byte in binary Buffer
;		ret: number of replacements, case-sensitive.
ReplaceByte( hayStackAddr, hayStackSize, ByteFrom=0, ByteTo=1, StartOffset=0, NumReps=-1)
{	Static fun
	IfEqual,fun,
	{
		h=
		( LTrim join
			5589E553515256579C8B4D0C8B451831D229C17E25837D1C00741F8B7D0801C70FB6451
			00FB65D14FCF2AE750D885FFF42FF4D1C740409C975EF9D89D05F5E5A595BC9C21800
		)
		VarSetCapacity(fun,StrLen(h)//2)
		Loop % StrLen(h)//2
			NumPut("0x" . SubStr(h,2*A_Index-1,2), fun, A_Index-1, "Char")
	}
	Return DllCall(&fun
		, "uint",haystackAddr, "uint",hayStackSize, "short",ByteFrom, "short",ByteTo
		, "uint",StartOffset, "int",NumReps)
}

[SKAN]

Ooh... Great! Thanks..

What is/does NumReps ?

[tic]

Number of replacements. -1 for all I guess

Edit:

Could I see the c++/asm please?

Thanks!

[wOxxOm]

NumReps is of course a limit of replacements to be made.

well the asm is ultimately primitive, however it works pretty fast (10MB zeroes -> 1 in less than 100ms on my old [email protected]00) - I just may assume that P4+ cpus have optimizations for such trivial memory-retrieval/storing schemes

here's the FASM code without compiler definitions for 'segments' and stuff.
BTW, I've tested the code just one time

proc ReplaceByte stdcall uses ebx ecx edx esi edi, hayStack, hayStackSize, ByteFrom:WORD, ByteTo:WORD, StartOffset, NumReps
	pushfd

	mov	ecx,[hayStackSize]
	mov	eax,[StartOffset]
	xor	edx,edx
	sub	ecx,eax
	jle	.done
	cmp	[NumReps],0
	jz	.done

	mov	edi,[hayStack]
	add	edi,eax ;edi=&(hayStack[StartOffset])

	movzx	eax,byte [ByteFrom]
	movzx	ebx,byte [ByteTo]
	cld

.rep:
	repne	scasb
	jne	.done

	mov	[edi-1],bl
	inc	edx
	dec	[NumReps]
	jz	.done
	or	ecx,ecx
	jnz	.rep

.done:
	popfd
	mov	eax,edx
	ret
endp

[tinku99]

Lexikos once wrote a script to enumerate the memory pages: here
Its straightforward to run binary buffer search once for each page in the list...
Then you can search through an entire process for a binary string, similar to this perl module: win32::process::memory.

[maraskan_user]

Did somebody have any luck with creating MCode for InBuf() that can work in AHK_L x64?

[RHCP]

Great function.

[Klark92]

The InBuf function is not working for me. I tested it on ReadProcessMemory output (string output). Can anyone tell me why is that ? Im using last ver of ahk.