Note that there are some explanatory texts on larger screens.

plurals
  1. POmsn plus script read/write memory
    primarykey
    data
    text
    <p>I'm writing on a MSN Plus script, which is in fact javascript.<br> For interop with Windows there is a class called <code>Interop</code>.<br> With its static function <code>Call</code> one can call s specified function in a specified dll with up to 12 arguments.<br> My goal is to write a script which gets a process name out of the PID.<br> I've done everything right, but it still doesn't work. </p> <pre>function GetProcNameFromPID(pid) { var hnd = Interop.Call("kernel32", "CreateToolhelp32Snapshot", 2, 0); var handle = Interop.Call("kernel32", "GetCurrentProcess"); var StructP = Interop.Allocate(4+4+4+4+4+4+4+4+4+260);//*Allocate space for the ProcessEntry32 struct* var hnd_ptr = Interop.Allocate(4); var ress = Interop.Call("kernel32", "WriteProcessMemory", handle, StructP, StructP.size.DataPtr, 4, hnd_ptr); Debug.Trace(ReadInt(hnd_ptr, 0)); var res = Interop.Call("kernel32", "Process32FirstW", hnd, StructP.DataPtr); if(!res) { Debug.Trace("FAAAAIIIILLLLL / " + Interop.Call("kernel32", "GetLastError") + " / " + ress); } else { do { var pos = 0; ReadInt(StructP, pos); ReadInt(StructP, pos); var owpid = ReadInt(StructP, pos); ReadInt(StructP, pos); ReadInt(StructP, pos); ReadInt(StructP, pos); var parpid = ReadInt(StructP, pos); ReadInt(StructP, pos); ReadInt(StructP, pos); ReadInt(StructP, pos); var name = ReadString(pos, 50); if(pid == owpid) return name; StructP = Interop.Allocate(4+4+4+4+4+4+4+8+4+50); Interop.Call("kernel32", "WriteProcessMemory", handle, StructP.DataPtr, StructP.size.DataPtr, 4, null); } while(Interop.Call("kernel32", "Process32NextW", hnd, StructP.DataPtr) == true) } } function ReadInt(buffer, pos) { var res = 0; for(var i = 0; i >> 24; var b2 = addr >> 24; var b3 = addr >> 24; var b4 = addr >> 24; return b4 + b3*256 + b2*256*256 + b1*256*256*256; } </pre> <hr> <p>The <code>Process32FirstW</code> function always suceeds, but the struct is empty.<br> The <code>WriteProcessMemory</code> function suceeds, too. But the number of written bytes is always 0. </p>
    singulars
    1. This table or related slice is empty.
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
 

Querying!

 
Guidance

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload