reading text value with readprocessmemory

I search google for example code and never found working one
so lets start
cheat engine directory contains a file named tutorial.exe
after a simple text scan WITH CE we found a green value AT address 40124c
it contains a text
that text is "welcome"
now my request is a source code to display this address value (welcome) in tlable or tedit or any other control
i mean read it as text not numbers
is this posable ??
can this dreem becomes a true ??
Please help me with a FULL example in delphi with the pervius condetions

---------- Post added 2011-06-04 at 05:07 AM ---------- Previous post was 2011-06-01 at 05:47 AM ----------

can any one tel me if this is imposable or posable ??

It's very easy... just use something like this

Code:

---

function getSTRING(Hdl, aPointer: Cardinal; length: integer): WideString;
var
  BytesRead: DWORD;
  buf: array of AnsiChar;
begin
  setlength(buf, length);
  ReadProcessMemory(Hdl, Pointer(aPointer), @buf, length, BytesRead);
  Result := string(buf);
end;

---

also, check another thread with Bot framework, coz my source contain a list of useful delphi function for memory read/write

[Only registered and activated users can see links. Click Here To Register...]

or array of char.

Try this code:

Code:

---

var
  Form1: TForm1;
  wnd1, wnd2: HWND;
  WindowName: Integer;
  ProcessId: Integer;
  ThreadId: Integer;
  Buf: PChar;
  HandleWindow: Integer;
  Write: Cardinal;
  WindowTitle: String= 'This_name_of_your_window';
  PokeValue: Cardinal= $FFFFFFFF;
  NumberOfBytes: Integer = 4;

---

Code:

---

function FindWindowByText (var WindowT: String): HWND;
var
  Wnd: hWnd;
  buff: array[0..127] of Char;
begin
  Result := 0;
  Wnd := GetWindow(fmMain.Handle, gw_HWndFirst);
  while Wnd <> 0 do
  begin
    if (Wnd <> Application.Handle) and
      IsWindowVisible(Wnd) and
      (GetWindow(Wnd, gw_Owner) = 0) and
      (GetWindowText(Wnd, buff, sizeof(buff)) <> 0) then
    begin
      GetWindowText(Wnd, buff, sizeof(buff));
      if pos(WindowT, StrPas(buff)) > 0 then
      begin
        Result := Wnd;
        WindowT := buff;
        Break;
      end;
    end;
    Wnd := GetWindow(Wnd, gw_hWndNext);
  end;
end;

---

Code:

---

function read_value3 (Address: Pointer; ASize: Cardinal; var AOut: Pointer): Cardinal;
var
  WindowH: DWORD;
  ThreadId: DWORD;
  ProcessId: DWORD;
  ProcessH: DWORD;
  s: String;
begin
  s := 'This_Name_of_your_window_program';
  WindowH := Find (s);
  ThreadId := GetWindowThreadProcessId (WindowH, ProcessId);
  ProcessH := OpenProcess (PROCESS_VM_READ, False, ProcessId);
  ReadProcessMemory(ProcessH, Address, AOut, ASize, Result);
  CloseHandle (ProcessH);
end;

---

Code:

---

function Read_String3 (Address: Pointer; ASize: Cardinal): String;
var
  buf: String;
begin
  SetLength (buf, ASize);
  if read_value3 (Address, ASize, Pointer(buf)) = ASize
  then
    Result := buf
  else
    Result := 'Where is window???';
end;

---

Code:

---

procedure TForm1.Button1Button(Sender: TObject);
var
res:int64;
s:string;
begin
res:=0;
s:= PAnsiChar(Read_String3(Pointer($000000), 200));
Edti1.Text:='>>' +s;
end;

---

P.S. I used this code on Delphi 2009.

So. How read string from strack (EBP) or register ECX like [Only registered and activated users can see links. Click Here To Register...] (dynamic addresses) ? :)

take care, some string are unicode.
unicode strings are code on 16 bits like ABCD is 41 42 43 44 and 41 00 42 00 43 00 44 00 in unicode
so with readprocessmemory u have to consider each char as a word, not as a byte.