Process Module
Contents
open
procHandle process.open(number procId)
Attempt to open and return a handle to a process for reading/writing. Accepts only the process's ID.
close
process.close(handle procHandle)
Closes an opened handle. If you set an open handle to nil, or if a handle goes out of scope, it will automatically close itself.
read
number|string process.read(handle procHandle, string type, number address[, number length])
Attempt to read memory from process 'procHandle' at the given address. 'type' should be "byte", "ubyte", "short", "ushort", etc. When reading a string, a maximum bytes to read should be given as 'length', otherwise do not specify length.
The type of data returned depends on the type requested. That is, requesting a byte, short, int, int64, float, or double returns a number while requesting a string returns a string. If this function should fail, it will return nil.
readPtr
number|string process.readPtr(handle procHandle, string type, number address, number|table offsets[, number length])
Exactly like process.read(), except it reads from a pointer.
'offsets' can be a number (single offset) or a table (multiple offsets). If a table is given for 'offsets', each value should be of type number.
readBatch
table process.readBatch(handle procHandle, number address, string mask)
Attempt to read memory from process 'proc' at the given address. 'mask' dictates what type(s) and how many variables should be read. Each character in 'mask' specifies the type to read or skip. A number prefixing the type can dictate the number to read (number types) or the length of a string.
| Character | Type |
| b | byte |
| B | unsigned byte |
| s | short |
| S | unsigned short |
| i | int |
| I | unsigned int |
| h | int64 |
| H | unsigned int64 |
| f | float |
| F | double |
| c | string |
| _ | (skip ahead; do not return this) |
"3i" means "read 3 integers" while "3c" means "read a string of length 3".
readChunk
chunk process.readChunk(handle procHandle, number address, number size)
See also: MemoryChunk_class
Reads a chunk of memory of a given size from a location. 'size' represents the number of bytes to read.
The chunk is an object that you can then use to extract the various data from. It is generally faster to read a chunk then extract from it than it is to do many single reads with process.read().
write
boolean process.write(handle procHandle, string type, number address, string|number data)
Attempt to write memory to process 'proc' at the given address. 'type' does not need to indicate signedness. (do not includes 'u' prefix) Strings also do not require length to be given.
Returns true on success, false on failure.
writePtr
boolean process.writePtr(handle procHandle, string type, number address, number|table offsets, number|string data)
See process.write().
'offsets' can be a number (single offset) or a table (multiple offsets). If a table is given for 'offsets', each value should be of type number.
findPattern
number process.findPattern(handle procHandle, number address, number length, string bitmask, string szmask)
Attempt to find a pattern within a process, beginning at memory address 'address', with a max scan length of 'length' (in bytes). 'bitmask' should contain an 'x' for a match, and '?' for wildcard. i.e. "xxxx?xx" 'szmask' should contain the actual data we are checking against for a match. i.e. "ABCD?FG"
Returns a number (the found address) on success and nil on failure or not found.
findByWindow
number process.findByWindow(number hwnd)
Returns the process ID that a window with handle 'hwnd' is owned by. If the function fails, it returns nil.
findByExe
number process.findByExe(string procname)
Look up a process ID by checking for its running executable. i.e. "explorer.exe"
If the process you are looking for is 64-bit, then you must use a 64-bit copy of MicroMacro, otherwise the process cannot be found.
getModuleAddress
number process.getModuleAddress(number procId, string moduleName)
Look up the address of a module within a process and return its origin address. Often this is used to lookup the location where a DLL is loaded. 'moduleName' should be the full name. i.e. "whatever.dll" If the function fails or it could not locate the module, it returns nil.
getModuleFilename
string process.getModuleFilename(handle process)
Returns the fully qualified path of the main executable of an opened (see process.open) process.
getModules
table process.getModules(number procId)
Returns a table of key/value pairs of every module found within the process specified by the process ID. Module names will be the key and the address within the program will be the value. If the function fails, it returns nil.
attachInput
boolean process.attachInput(number hwnd)
Attach our input thread to the target window. Returns true on success, false on failure.
detachInput
boolean process.detachInput(number hwnd)
Detach our input thread from the target window. Returns true on success, false on failure.
is32bit
boolean process.is32bit(handle proc)
Returns true if the target process is 32-bit.
is64bit
boolean process.is64bit(handle proc)
Returns true if the target process is 64-bit.
terminate
boolean process.terminate(handle proc)
boolean process.terminate(handle proc, number exitCode = 0)
Attempts to terminate the target process. Returns true on success, or false on failure. 'exitCode' is an optional identifier you can use to specify the reason it is being terminated.
getWindows
table process.getWindows(number procId)
Returns a list of tables containing the 'hwnd' (handle to window), 'name' (window title), and 'class' of each window that belongs to the process specified by the process ID. For more information on the return value, see window.findList().
