$ahMem = _MemOpen(7176) ;Процесс Opera.exe (от установщика)
$sRead = _MemSearch($ahMem, '(?i)[a-z]:\\.*', 0x00000000, 0x06000000, 5120)
_MemClose($ahMem)
ConsoleWrite($sRead & @LF)
Func _MemSearch($ah_Mem, $sPattern, $iStartAddress, $iStopAddress, $iStep)
If Not IsArray($ah_Mem) Then
Return SetError(1)
EndIf
If StringLen($sPattern) = 0 Then
Return SetError(2)
EndIf
For $iAddress = $iStartAddress To $iStopAddress Step $iStep
$sRead = _MemRead($ah_Mem, $iAddress, $iStep)
If StringRegExp($sRead, $sPattern) Then
Return $sRead
EndIf
Next
Return SetError(3)
EndFunc ;==>_MemSearch
Func _MemOpen($i_Pid, $i_Access = 0x1F0FFF, $i_Inherit = 0)
Local $av_Return[2] = [DllOpen('kernel32.dll') ]
Local $ai_Handle = DllCall($av_Return[0], 'int', 'OpenProcess', 'int', $i_Access, 'int', $i_Inherit, 'int', $i_Pid)
If @error Then
DllClose($av_Return[0])
SetError(1)
Return 0
EndIf
$av_Return[1] = $ai_Handle[0]
Return $av_Return
EndFunc ;==>_MemOpen
Func _MemRead($ah_Mem, $i_Address, $i_Size = 0)
If $i_Size = 0 Then
Local $v_Return = ''
Local $v_Struct = DllStructCreate('byte[1]')
Local $v_Ret
While 1
$v_Ret = DllCall($ah_Mem[0], 'int', 'ReadProcessMemory', 'int', $ah_Mem[1], 'int', $i_Address, 'ptr', DllStructGetPtr($v_Struct), 'int', 1, 'int', '')
$v_Ret = DllStructGetData($v_Struct, 1)
If $v_Ret = 0 Then ExitLoop
$v_Return &= Chr($v_Ret)
$i_Address += 1
WEnd
Else
Local $v_Struct = DllStructCreate('byte[' & $i_Size & ']')
Local $v_Ret = DllCall($ah_Mem[0], 'int', 'ReadProcessMemory', 'int', $ah_Mem[1], 'int', $i_Address, 'ptr', DllStructGetPtr($v_Struct), 'int', $i_Size, 'int', '')
Local $v_Return[$v_Ret[4]]
For $i = 0 To $v_Ret[4] - 1
$v_Return[$i] = DllStructGetData($v_Struct, 1, $i + 1)
Next
EndIf
Return $v_Return
EndFunc ;==>_MemRead
Func _MemClose($ah_Mem)
Local $av_Ret = DllCall($ah_Mem[0], 'int', 'CloseHandle', 'int', $ah_Mem[1])
DllClose($ah_Mem[0])
Return $av_Ret[0]
EndFunc ;==>_MemClose
