-
Notifications
You must be signed in to change notification settings - Fork 72
/
MemLib.ahk
75 lines (65 loc) · 1.9 KB
/
MemLib.ahk
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
;--V1.1 Written by AmA--
;--V1.1.1 Written by Maupa
;~ ReadMemoryPointer
;~ WriteMemoryPointer
OpenMemoryfromProcess(process,right=0x1F0FFF)
{
Process,Exist,%process%
PID = %ErrorLevel%
HWND := DllCall("OpenProcess","Uint",right,"int",0,"int",PID)
return HWND
}
OpenMemoryfromTitle(title,right=0x1F0FFF)
{
WinGet,PID,PID,%title%
HWND := DllCall("OpenProcess","Uint",right,"int",0,"int",PID)
return HWND
}
CloseMemory(hwnd)
{
return DllCall("CloseHandle", "int", hwnd)
}
WriteMemory(hwnd,address,writevalue,datatype="int",length=4,offset=0)
{
VarSetCapacity(finalvalue,length, 0)
NumPut(writevalue,finalvalue,0,datatype)
return DllCall("WriteProcessMemory","Uint",hwnd,"Uint",address+offset,"Uint",&finalvalue,"Uint",length,"Uint",0)
}
ReadMemory(hwnd,address,datatype="int",length=4,offset=0)
{
VarSetCapacity(readvalue,length, 0)
DllCall("ReadProcessMemory","Uint",hwnd,"Uint",address+offset,"Str",readvalue,"Uint",length,"Uint *",0)
finalvalue := NumGet(readvalue,0,datatype)
return finalvalue
}
ReadMemoryPointer(hProcess, baseAddress, dataTyp="int", length=4, offsets*) {
for i, offset in offsets
baseAddress := ReadMemory(hProcess, baseAddress, "ptr", 8) + offset
return ReadMemory(hProcess, baseAddress, dataTyp, length)
}
WriteMemoryPointer(hProcess, baseAddress, writeValue=0, dataTyp="int", length=4, offsets*) {
for i, offset in offsets
baseAddress := ReadMemory(hProcess, baseAddress, "ptr", 8) + offset
return WriteMemory(hProcess, baseAddress, writeValue, dataTyp, length)
}
SetPrivileg(privileg = "SeDebugPrivilege")
{
success := DllCall("advapi32.dll\LookupPrivilegeValueA","uint",0,"str",privileg,"int64*",luid_SeDebugPrivilege)
if (success = 1) && (ErrorLevel = 0)
{
returnval = 0
}
else
{
returnval = %ErrorLevel%
}
return %returnval%
}
Suspendprocess(hwnd)
{
return DllCall("ntdll\NtSuspendProcess","uint",hwnd)
}
Resumeprocess(hwnd)
{
return DllCall("ntdll\NtResumeProcess","uint",hwnd)
}