Function SearchMemory

modules/utils/remote/remote.go:29–62

(handle windows.Handle, pattern []byte, todesk bool)

	return buffer, nil
}
func SearchMemory(handle windows.Handle, pattern []byte, todesk bool) ([]uintptr, []byte, error) {
	var results []uintptr
	var memoryInfo windows.MemoryBasicInformation
	var datas []byte
	if todesk {
		datas = make([]byte, 0)
	}
	address := uintptr(0)
	for {
		err := windows.VirtualQueryEx(handle, address, &memoryInfo, unsafe.Sizeof(memoryInfo))
		if err != nil || memoryInfo.RegionSize == 0 {
			break
		}

		if memoryInfo.State == windows.MEM_COMMIT && (memoryInfo.Protect&windows.PAGE_READWRITE) != 0 {
			data, err := ReadMemory(handle, memoryInfo.BaseAddress, uint32(memoryInfo.RegionSize))
			if err == nil {
				if todesk {
					datas = append(datas, data...)
				}
				for i := 0; i < len(data)-len(pattern); i++ {
					if MatchPattern(data[i:i+len(pattern)], pattern) {
						results = append(results, memoryInfo.BaseAddress+uintptr(i))
					}
				}
			}
		}
		address = memoryInfo.BaseAddress + uintptr(memoryInfo.RegionSize)
	}
	if todesk {
		return results, datas, nil
	}
	return results, nil, nil
}
func MatchPattern(data, pattern []byte) bool {
	for i := range pattern {
		if data[i] != pattern[i] {