Codefuser

Still looking for help with this. HMU.

Still looking for help. Someone's help would be greatly appreciated.

Still looking for help. Someone's help would be greatly appreciated.

Still looking for help. Would love to get some.

Still looking for help with this, any will be appreciated.

Yes it is indeed for my obfuscation project. It is for scanning the memory for known signature of unwanted softwares (Debuggers, decompilers, dissasemblers, VMWare, etc). It is also for a part of another heuristic memory scanner project of mine.

I have tried searching and I found this example: https://www.autoitscript.com/forum/topic/66210-_searchprocessmemory/ However it does not work. After some debugging I found that $lpMinimumApplicationAddress is positive and $lpMaximumApplicationAddress is negative. Tried switching them around and that didn't work either. Can anyone help?

Thanks for your help, I was confused by the self-referencing in the structure

There is a way for you to sorta do it if the file you are downloading will still work with normal integrity. You can try to edit the manifest of the file in the resource to set the execution level to asInvoker instead of RequireAdministrator and that will remove the prompt.

How do I process this type of structure? I have never seen anything like this before Also how do I create a structure like this in AutoIt using DllStructCreate? I need to create one in order to call ReadProcessMemory to copy a remote structure that's like this into my own process.

It is to patch a few bytes in UPX-ed executables to make it slightly harder to unpack.

So something like $file = FileOpen("file.exe",1) FileSetPos($file, "0x45FFF", 0) But then how many characters are in an offset?

Any ideas on how I can patch an offset of an external file from AutoIt? I want to figure out to overwrite that offset with random data.

Thanks for the help. Fixed the error.

Script: http://pastebin.com/faUJweAG Screenshot of error: https://gyazo.com/0bbe7c840b8872ca98bec57d02e1f4bc I don't see anything wrong with the script and it runs perfectly (It creates a messagebox). It is an output from my obfuscator if you are wondering if only junk code is generated. Scite output:http://pastebin.com/0rUVJb6F