NAME

Win32::Process::Memory - read and write memory of other windows process

SYNOPSIS

  # open process
  my $proc = Win32::Process::Memory->new({ name=>'cmd.exe' });

  # do debug
  printf "\nTotal Memory = 0x%X\n", $proc->get_memtotal;
  print "\nMemory block list:\n";
  my %memlist = $proc->get_memlist;
  printf "  %08X -> %08X : Len=0x%X\n", $_, $_+$memlist{$_}, $memlist{$_}
      foreach (sort {$a <=> $b} keys %memlist);
  print "\nContent of 0x10004 -> 0x10103\n";
  print $proc->hexdump(0x10004, 0x100);

  # search a sequence of unsigned int16
  print "\nFind a sequence of unsinged int16:\n";
  my @results = $proc->search_u16(92, 87, 105, 110, 51, 50);
  print $proc->hexdump($_, 0x32)."\n" foreach @results;

  # read and change value
  printf "\n0x%X [unsigned int16] : %d\n", 0x10004, $proc->get_u16(0x10004);
  printf "0x%X [unsigned int32] : %d\n", 0x10004, $proc->get_u32(0x10004);
  #$proc->set_u32(0x10004, 55); # BE CAREFUL, MAY DAMAGE YOUR SYSTEM

  # close process
  undef $proc;

DESCRIPTION

read and write memory of other windows process.

new

  $proc = Win32::Process::Memory->new({ pid=num, name=>str, access=>'read/write/query/all' });
  $proc = Win32::Process::Memory->new({ pid  => 1522 });
  $proc = Win32::Process::Memory->new({ name => 'cmd.exe' });
  $proc = Win32::Process::Memory->new({ pid  => 1522, access => 'read' });

get_memlist

  my %memlist = $proc->get_memlist;
  printf "  %08X -> %08X : Len=0x%X\n", $_, $_+$memlist{$_}, $memlist{$_}
      foreach (sort {$a <=> $b} keys %memlist);

get_memtotal

  printf "Commited Memory = %X Bytes\n", $proc->get_memtotal;

hexdump

  print $proc->hexdump($from, $len);

get

  $getbytes = $proc->get_buf($from, $len, $buf);
               # return 0 if failed
  $getvalue = $proc->get_pack($packtype, $packunit_len, $from, $undef_val);
               # return $undef_val if failed
  $getvalue = $proc->get_packs($packtype, $packunit_len, $from, $pack_nums, $undef_val);
  $getvalue = $proc->get_i8($from, $undef_val);
  $getvalue = $proc->get_u8($from, $undef_val);
  $getvalue = $proc->get_i16($from, $undef_val);
  $getvalue = $proc->get_u16($from, $undef_val);
  $getvalue = $proc->get_i32($from, $undef_val);
  $getvalue = $proc->get_u32($from, $undef_val);
  $getvalue = $proc->get_float($from, $undef_val);
  $getvalue = $proc->get_double($from, $undef_val);

set

  $setbytes = $proc->set_buf($from, $buf);
               # return 0 if failed
  $setbytes = $proc->set_pack($packtype, $from, ...);
  $setbytes = $proc->set_packs($packtype, $from, ...);
  $setbytes = $proc->set_i8($from, $undef_val);
  $setbytes = $proc->set_u8($from, $undef_val);
  $setbytes = $proc->set_i16($from, $undef_val);
  $setbytes = $proc->set_u16($from, $undef_val);
  $setbytes = $proc->set_i32($from, $undef_val);
  $setbytes = $proc->set_u32($from, $undef_val);
  $setbytes = $proc->set_float($from, $undef_val);
  $setbytes = $proc->set_double($from, $undef_val);

search

  Search all commited area of given process.
  $proc->search_sub($pattern, sub {...});
               # call sub when founded, $_[0] is the starting address of match
  @results = $proc->search_string($pattern);
               # return starting addresses of every match as an array
  %hash    = $proc->search_string_hash($patttern);
               # return hash, which key is $1 of match, and which value is starting address
  @results = $proc->search_pack($packtype, ...);
               # ... is the arguments of pack function
  @results = $proc->search_packs($packtype, ...);
               # ... is a list of 1 arguments of pack function
  @results = $proc->search_i8(48);
  @results = $proc->search_u8(48, 56, ...);
  @results = $proc->search_i16(48, 56, ...);
  @results = $proc->search_u16(48, 56, ...);
  @results = $proc->search_i32(48, 56, ...);
  @results = $proc->search_u32(48, 56, ...);
  @results = $proc->search_float(48, 56, ...);
  @results = $proc->search_double(48, 56, ...);

search_range

  Search a specific range ($from, $len). The caller should ensure that the range is valid.
  $proc->search_range_sub($from, $len, $pattern, sub {...});
               # call sub when founded, $_[0] is the start address of match
  @results = $proc->search_range_string($from, $len, $pattern);
               # return starting addresses of every match as an array
  %hash    = $proc->search_range_string_hash($from, $len, $patttern);
               # return hash, which key is $1 of match, and which value is starting address
  @results = $proc->search_range_pack($packtype, ...);
               # ... is the arguments of pack function
  @results = $proc->search_range_packs($packtype, ...);
               # ... is a list of 1 arguments of pack function
  @results = $proc->search_range_i8(48);
  @results = $proc->search_range_u8(48, 56, ...);
  @results = $proc->search_range_i16(48, 56, ...);
  @results = $proc->search_range_u16(48, 56, ...);
  @results = $proc->search_range_i32(48, 56, ...);
  @results = $proc->search_range_u32(48, 56, ...);
  @results = $proc->search_range_float(48, 56, ...);
  @results = $proc->search_range_double(48, 56, ...);

BUGS, REQUESTS, COMMENTS

Please report any requests, suggestions or bugs via http://rt.cpan.org/NoAuth/ReportBug.html?Dist=Win32-Process-Memory

COPYRIGHT AND LICENSE

Copyright 2004 Qing-Jie Zhou <qjzhou@hotmail.com>

This library is free software; you can redistribute it and/or modify it under the same terms as Perl itself.