set bp(eb fe) on that offset
then use this function:
Quote:
function SniffSerial(PI: PROCESS_INFORMATION; Ctx: _Context): string;
var
X: Cardinal;
Buff: PChar;
begin
GetMem(Buff,50);
SuspendThread(PI.hThread);
GetThreadContext(PI.hThread,Ctx);
ReadProcessMemory(PI.hProcess,Pointer(Ctx.Edx),Buff,50,X);
Result:=trim(Buff) ;
FreeMem(Buff);
end;
|
thanks NimaSubZero & anorganix
you can use this source