Arbeitsspeicher schnell durchsuchen

[brechi]

Delphi-Quellcode:

procedure MemLesen(ProcessID: integer);
var
  ProcessHandle: THandle;
  StartMem: DWord;
  lpBuffer: TMemoryBasicInformation;
  myMem: Pointer;
  dwRead: DWord;
  dwOld: DWord;
begin
  ProcessHandle := OpenProcess(PROCESS_ALL_ACCESS, false, ProcessID);

  if (ProcessHandle <> 0) then
  begin
    StartMem := 0;
    while (StartMem <> $80000000) do
    begin
      if VirtualQueryEx(ProcessHandle, Pointer(StartMem), lpBuffer, SizeOf(lpBuffer)) = SizeOf(lpBuffer) then
      begin
        if VirtualProtectEx(ProcessHandle, lpBuffer.AllocationBase, lpBuffer.RegionSize, PAGE_EXECUTE_READWRITE, dwOld) then
        begin
          myMem := VirtualAlloc(nil, lpBuffer.RegionSize, MEM_COMMIT or MEM_RESERVE, PAGE_EXECUTE_READWRITE);
          if (myMem <> nil) then
          begin
            if ReadProcessMemory(ProcessHandle, lpBuffer.AllocationBase, myMem, lpBuffer.RegionSize, dwRead) and (lpBuffer.RegionSize = dwRead) then
            begin
              Form1.ListBox1.Items.Add('Speicher gelesen: '+IntTohex(DWord(lpBuffer.AllocationBase),8)+', '+
                                        'Größe: '+IntToHex(lpBuffer.RegionSize,8)+', '+
                                        'gespeichert in: '+InttoHex(DWord(myMem),8));
            end;
            VirtualFree(myMem, 0, MEM_RELEASE);
          end;
          VirtualProtectEx(ProcessHandle, lpBuffer.AllocationBase, lpBuffer.RegionSize, dwOld, dwOld);
        end;
        if (lpBuffer.RegionSize <> 0) then
          inc(startMem, lpBuffer.RegionSize) else
          startMem := startMem+$1000;
      end else
        inc(StartMem,$1000);
    end;

  end;

end;

sollte in etwa so gehen