Hilfe bei Memory

;==================================================================================
; Function:         _MemoryScan($ah_Handle, $pattern [, $after[, $iv_addrStart, [$iv_addrEnd]]])
; Description:      Finds the address of the first occurance of a pattern in a process.
; Parameter(s):     $ah_Handle - An array containing the Dll handle and the handle
;                                of the open process as returned by _MemoryOpen().
;                   $pattern - The pattern you want to find. Provide the pattern
;                              as a String of hex values. You may use the '.' as wildcard.
;                              Any other character as '0123456789ABCDEFabcdef.' is ignored.
;                              Example: "55 8B .. 83"
;                   $after - (optional) Set to FALSE by default.
;                            If set to TRUE, the method will return the address
;                            after the pattern, else the method returns the address
;                            of the pattern itself.
;                   $iv_addrStart - (optional) Set to 0x00400000 by default.
;                                   This is the address where the method begins to scan
;                                   for the pattern. It must be in hex format (0x00000000).
;                   $iv_addrEnd - (optional) Set to 0X00FFFFFF by default.
;                                 This is the address where the method stops to scan
;                                 for the pattern. It must be in hex format (0x00000000).
; Requirement(s):   None.
; Return Value(s):  On Success - Returns the address of the first occurance of the pattern
;                                ($after = FALSE) or the address after the first occurance
;                                of the pattern ($after = TRUE). The address is in
;                                hexadecimal format.
;                   On Failure - Returns -1
;                   @Error - 0 = No error.
;                            1 = Invalid $ah_Handle.
;                            2 = Invalid $pattern.
; Author(s):        Luzifer42
; Note(s):          The default scan range will be completed in less than one second.
;==================================================================================
#RequireAdmin
;~ #include <NomadMemory.au3>
#include <Array.au3>
#include <ButtonConstants.au3>
#include <GUIConstantsEx.au3>
#include <WindowsConstants.au3>
#include <SkinCrafterUDF.au3>
#include "KDMemory.au3"
_LoadSkinCrafter("Skindll.dll")
#Region ### START Koda GUI section ### Form=
$Form1 = GUICreate("Adress Searcher", 684, 508, 531, 279)
_InitializeSkinCrafter($Form1,"macos.skf")
$Button1 = GUICtrlCreateButton("Start", 192, 208, 281, 57)
$Button2 = GUICtrlCreateButton("State:", 192, 272, 281, 49)
GUICtrlSetFont(-1, 14, 800, 0, "MS Sans Serif")
GUISetState(@SW_SHOW)
#EndRegion ### END Koda GUI section ###

While 1
	$nMsg = GUIGetMsg()
	Switch $nMsg
		Case $GUI_EVENT_CLOSE
			Exit
		Case $Button1
			MsgBox(48,"","Warte auf S4 League")
			ProcessWait("S4Client.exe")
			Sleep(1500)
			_ProcessSuspend("S4Client.exe")
			GUICtrlSetData($Button2,"Searching")
;~ 			$array = _MemorySearch(ProcessExists("S4Client.exe"), "6A 01 8B 8D 44 FF FF FF 83", 0x00400000, 0x00900000)
			$Adressen=_MemoryScan(_KDMemory_OpenProcess(ProcessExists("S4Client.exe")),"6A 01 8B 8D 44 FF FF FF 83")
			_ArrayDisplay($Adressen)
	EndSwitch
WEnd


#cs

Func _MemorySearch($pPid, $pWert, $pAnfang, $pEnde)
	Local $vCall[99]
    If Not ProcessExists($pPid) Then Return SetError(1, "", -1)
    If IsFloat($pWert) Then Return SetError(2, "", -1)
    If $pAnfang > $pEnde Then Return SetError(2, "", -1)
    Local $vAnfang = $pAnfang, $vStruct, $vCall[2], $vIndex
    Dim $vArray[1] = [0]
    Do
        $vStruct = DllStructCreate("DWORD Adress[255];int Index")
        $vCall = DllCall(@ScriptDir & "\MemorySearch.dll", "int:cdecl", "MemorySearch", "int", $pPid, "DWORD", $pWert, "int", $vAnfang, "int", $pEnde, "int", DllStructGetPtr($vStruct))
        $vIndex = DllStructGetData($vStruct, "Index")
        For $i = 0 To $vIndex - 1
            ReDim $vArray[UBound($vArray) + 1]
            $vArray[UBound($vArray) - 1] = DllStructGetData($vStruct, "Adress", $i + 1)
            $vArray[0] += 1
        Next
        If UBound($vArray) > 1 Then $vAnfang = $vArray[UBound($vArray) - 1] + 1
		FileWriteLine("test.txt",$vArray)
    Until $vCall=1
    Return $vArray
EndFunc   ;==>_MemorySearch
#ce
Func _ProcessSuspend($process)
$processid = ProcessExists($process)
If $processid Then
    $ai_Handle = DllCall("kernel32.dll", 'int', 'OpenProcess', 'int', 0x1f0fff, 'int', False, 'int', $processid)
    $i_sucess = DllCall("ntdll.dll","int","NtSuspendProcess","int",$ai_Handle[0])
    DllCall('kernel32.dll', 'ptr', 'CloseHandle', 'ptr', $ai_Handle)
    If IsArray($i_sucess) Then
        Return 1
    Else
        SetError(1)
        Return 0
    Endif
Else
    SetError(2)
    Return 0
Endif
EndFunc

Func _ProcessResume($process)
$processid = ProcessExists($process)
If $processid Then
    $ai_Handle = DllCall("kernel32.dll", 'int', 'OpenProcess', 'int', 0x1f0fff, 'int', False, 'int', $processid)
    $i_sucess = DllCall("ntdll.dll","int","NtResumeProcess","int",$ai_Handle[0])
    DllCall('kernel32.dll', 'ptr', 'CloseHandle', 'ptr', $ai_Handle)
    If IsArray($i_sucess) Then
        Return 1
    Else
        SetError(1)
        Return 0
    Endif
Else
    SetError(2)
    Return 0
Endif
EndFunc


Func _MemoryScan($ah_Handle, $pattern, $after=false, $iv_addrStart=0x00400000, $iv_addrEnd=0X00FFFFFF, $step=51200)
	$lpBaseAddress = _KDMemory_GetModuleBaseAddress($ah_Handle,"S4Client.exe")
	If Not IsArray($ah_Handle) Then
		SetError(1)
        Return -1
	EndIf
	$pattern=StringRegExpReplace($pattern, "[^0123456789ABCDEFabcdef.]", "")
	IF StringLen($pattern)=0 Then
		SetError(2)
        Return -2
	EndIf
	For $addr=$iv_addrStart To $iv_addrEnd Step $step-(StringLen($pattern)/2)
		StringRegExp(_KDMemory_ReadProcessMemory($ah_Handle, $lpBaseAddress, "byte[" & $step & "]"), $pattern, 1, 2)
		If Not @Error Then
			If $after Then
				return StringFormat("0x%.8X", $addr+((@Extended-2)/2))
			Else
				return StringFormat("0x%.8X", $addr+((@Extended-StringLen($pattern)-2)/2))
			EndIf
		EndIf
	Next
	Return -3
EndFunc