- A small 'MemoryEngine' for dumping and modifying a process memory.
- The FullDump Function will dump the whole process to a byte array.
- The PartDump Function will dump a part of the process within the address bounds you enter.
- The WriteToAbsoluteAddress will write to a absolute address in memory (There is no guarantee that it is within the process memory region.) The Buffer paramter contains the data to write.
- The WriteToDynamicAddress will write to a specific address that is calcualted using the following formula Baseaddress of the Process + Your Address = ReadAddress. The Buffer Paramter contains the data to write.
- Give Credits and don't leech
Code
Module MemoryEngine
#Region "Dumping"
Public Function FullDump(ByVal ID As Integer) As Byte()
Try
Dim p As Process = Process.GetProcessById(ID)
Dim data(p.MainModule.ModuleMemorySize - 1) As Byte
ReadProcessMemory(p.Handle, p.MainModule.BaseAddress, data, data.Length, 0)
Return data
Catch ex As Exception
Return Nothing
End Try
End Function
Public Function PartDump(ByVal ID As Integer, ByVal Address As Integer, ByVal lenght As Integer) As Byte()
Try
Dim p As Process = Process.GetProcessById(ID)
Dim data(lenght - 1) As Byte
ReadProcessMemory(p.Handle, New IntPtr(p.MainModule.BaseAddress.ToInt32 + Address), data, data.Length, 0)
Return data
Catch ex As Exception
Return Nothing
End Try
End Function
#End Region
#Region "Writing"
Public Function WriteToAbsoluteAddress(ByVal ID As Integer, ByVal Address As Integer, ByVal Buffer As Byte()) As Boolean
Try
Dim p As Process = Process.GetProcessById(ID)
Return WriteProcessMemory(p.Handle, New IntPtr(Address), Buffer, Buffer.Length, IntPtr.Zero)
Catch ex As Exception
Return False
End Try
End Function
Public Function WriteToDynamicAddress(ByVal ID As Integer, ByVal Address As Integer, ByVal Buffer As Byte()) As Boolean
Try
Dim p As Process = Process.GetProcessById(ID)
Return WriteProcessMemory(p.Handle, New IntPtr(p.MainModule.BaseAddress.ToInt32 + Address), Buffer, Buffer.Length, IntPtr.Zero)
Catch ex As Exception
Return False
End Try
End Function
#End Region
#Region "APIs"
<DllImportAttribute("kernel32.dll", EntryPoint:="ReadProcessMemory", SetLastError:=True)> _
Private Function ReadProcessMemory(<InAttribute()> ByVal hProcess As System.IntPtr, <InAttribute()> ByVal lpBaseAddress As System.IntPtr, <Out()> ByVal lpBuffer As Byte(), ByVal nSize As UInteger, <OutAttribute()> ByRef lpNumberOfBytesRead As UInteger) As <System.Runtime.InteropServices.MarshalAsAttribute(System.Runtime.InteropServices.UnmanagedType.Bool)> Boolean
End Function
<DllImportAttribute("kernel32.dll", EntryPoint:="ReadProcessMemory", SetLastError:=True)> _
Private Function WriteProcessMemory(<InAttribute()> ByVal hProcess As System.IntPtr, <InAttribute()> ByVal lpBaseAddress As System.IntPtr, <Out()> ByVal lpBuffer As Byte(), ByVal nSize As UInteger, <OutAttribute()> ByRef lpNumberOfBytesWritten As UInteger) As <System.Runtime.InteropServices.MarshalAsAttribute(System.Runtime.InteropServices.UnmanagedType.Bool)> Boolean
End Function
#End Region
End Module
![[Image: wyEbCMi.png]](https://i.imgur.com/wyEbCMi.png)
