Process Module
Contents
open()
procHandle process.open(number procId)
Attempt to open and return a handle to a process for reading/writing. Accepts only the process's ID.
close()
process.close(handle procHandle)
Closes an opened handle. If you set an open handle to nil, or if a handle goes out of scope, it will automatically close itself.
read()
number|string process.read(handle procHandle, string type, number address[, number length])
Attempt to read memory from process 'procHandle' at the given address. 'type' should be "byte", "ubyte", "short", "ushort", etc. When reading a string, a maximum bytes to read should be given as 'length', otherwise do not specify length.
The type of data returned depends on the type requested. That is, requesting a byte, short, int, int64, float, or double returns a number while requesting a string returns a string. If this function should fail, it will return nil.
readPtr()
number|string process.readPtr(handle procHandle, string type, number address, number|table offsets[, number length])
Exactly like process.read(), except it reads from a pointer.
'offsets' can be a number (single offset) or a table (multiple offsets). If a table is given for 'offsets', each value should be of type number.
readBatch()
table process.readBatch(handle procHandle, number address, string mask)
Attempt to read memory from process 'proc' at the given address. 'mask' dictates what type(s) and how many variables should be read. Each character in 'mask' specifies the type to read or skip. A number prefixing the type can dictate the number to read (number types) or the length of a string.
| Character | Type |
| b | byte |
| B | unsigned byte |
| s | short |
| S | unsigned short |
| i | int |
| I | unsigned int |
| j | int64 |
| J | unsigned int64 |
| f | float |
| F | double |
| c | string |
| _ | (skip ahead; do not return this) |
"3i" means "read 3 integers" while "3c" means "read a string of length 3".
readChunk()
chunk process.readChunk(handle procHandle, number address, number size)
See also: MemoryChunk_class
Reads a chunk of memory of a given size from a location. 'size' represents the number of bytes to read.
The chunk is an object that you can then use to extract the various data from. It is generally faster to read a chunk then extract from it than it is to do many single reads with process.read().
write()
boolean process.write(handle procHandle, string type, number address, string|number data)
Attempt to write memory to process 'proc' at the given address. 'type' does not need to indicate signedness. (do not includes 'u' prefix) Strings also do not require length to be given.
Returns true on success, false on failure.
writePtr()
boolean process.writePtr(handle procHandle, string type, number address, number|table offsets, number|string data)
See process.write().
'offsets' can be a number (single offset) or a table (multiple offsets). If a table is given for 'offsets', each value should be of type number.
findPattern()
number process.findPattern(handle procHandle, number address, number length, string bitmask, string szmask)
Attempt to find a pattern within a process, beginning at memory address 'address', with a max scan length of 'length' (in bytes). 'bitmask' should contain an 'x' for a match, and '?' for wildcard. i.e. "xxxx?xx" 'szmask' should contain the actual data we are checking against for a match. i.e. "ABCD?FG"
Returns a number (the found address) on success and nil on failure or not found.
findByWindow()
number process.findByWindow(number hwnd)
Returns the process ID that a window with handle 'hwnd' is owned by. If the function fails, it returns nil.
findByExe()
number process.findByExe(string procname)
Look up a process ID by checking for its running executable. i.e. "explorer.exe"
getModuleAddress()
number process.getModuleAddress(handle procHandle, string moduleName)
Look up the address of a module within a process and return its origin address. Often this is used to lookup the location where a DLL is loaded. 'moduleName' should be the full name. i.e. "whatever.dll" If the function fails or it could not locate the module, it returns nil.
attachInput()
boolean process.attachInput(number hwnd)
Attach our input thread to the target window. Returns true on success, false on failure.
detachInput(number hwnd)
boolean process.detachInput()
Detach our input thread from the target window. Returns true on success, false on failure.
