Delphi - Writing To Memory

[quote='lolsee2' pid='123270' dateline='1306652115']
A short tutorial on writing memory to a process.

~Stating the Variables
Var
Pid: Integer;
Pidhandle: integer;


I'll explain it One by one

Pid The process id which is needed for us to write to memory
Pidhandle Kinda of same thing but a little different

Right now the value is at 0 because we have not used it

~Stating the Constant
Const
process = 'PRocess.exe'

Ok, Now we are stating what the process Is, In this case, fill out your process your going to write to.

Now Time to find the ID of a Process.
~Finding ID

First of all Add tlhelp32 to the uses list because this function requires it.

function GetID(Const ExeFileName: string; var ProcessId: integer): boolean;
var
ContinueLoop: BOOL;
FSnapshotHandle: THandle;
FProcessEntry32: TProcessEntry32;
begin
result := false;
FSnapshotHandle := CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
FProcessEntry32.dwSize := Sizeof(FProcessEntry32);
ContinueLoop := Process32First(FSnapshotHandle, FProcessEntry32);
while integer(ContinueLoop) <> 0 do begin
if (StrIComp(PChar(ExtractFileName(FProcessEntry32.szExeFile)), PChar(ExeFileName)) = 0)
or (StrIComp(FProcessEntry32.szExeFile, PChar(ExeFileName)) = 0) then begin
ProcessId:= FProcessEntry32.th32ProcessID;
result := true;
break;
end;
ContinueLoop := Process32Next(FSnapshotHandle, FProcessEntry32);
end;
CloseHandle(FSnapshotHandle);
end;

Now mainly focus on this Line

function GetID(Const ExeFileName: string; var ProcessId: integer): boolean;

This is the Function: GetID The Parameters are, The FILENAME, and THE PID which you have stated.


Let's use it!

~Using GetID();
Let's do this on a Button Click, and it will Show the Value of ID.

procedure TForm1.Button1Click(Sender: TObject);
begin
if GetID(process, Pid) then
Showmessage(IntToStr(Pid));


Now you Have your GetID function!
~Writing Memory

WriteProcessMemory(Pidhandle, Pointer(Address), @NewValue, Data, Written);

The WPM needs, The Process Handle, THe Addres, The New Value, the size of the Value/address(forgot O.O) and the Write. State it like this.

Var
Address: Cardinal
NewValue: Integer;
Data: Integer;
Written: Cardinal

REMEMBER!
byte = 1 byte
word = 2 bytes
cardinal = 4 bytes

This seems alright but now, How do We get the PIDHANDLE?

~OpenProcess
We will use OpenProcess() to get the PidHandle
Pidhandle := OpenProcess(PROCESS_ALL_ACCESS,False,Pid);


~Getting it All Together

Var
Pid: Integer;
Pidhandle: integer;
Address: Cardinal
NewValue: Integer;
Data: Integer;
Written: Cardinal;

procedure TForm1.Button1Click(Sender: TObject);
begin

Address := $04000000;
NewValue := 666;
Data := 4;

if GetID(process,Pid) then
begin
Pidhandle := OpenProcess(PROCESS_ALL_ACCESS,False,Pid);
WriteProcessMemory(Pidhandle, Pointer(Address), @NewValue, Data, Written);
closehandle(Pidhandle);
end else
begin
MessageDlg('OMG What the Fck?! Process Not FOUND!', mtwarning, [mbOK],0);
end;

THe Main overview is that the Program will try to find the Process and If not, a mesage box will appear saying Process Not FOUND!
Hope tt you have learned smth from this tut.

Credits: kaswar.

[/quote]