The correct way to retrieve notepad's text content is to locate the HWND
of notepad's edit field, using FindWindowEx()
or EnumChildWindows()
or similar, and then send it a WM_GETTEXT
message.
But if you must dump Notepad's allocated memory, then you need to fix your code. It is ignoring errors, and not writing the retrieved data to your file correctly. Try something more like this instead:
uses
Windows,
TLHelp32,
SysUtils;
var
err: DWORD;
sysinfo: TSystemInfo;
Handle: THandle;
Mbi: TMemoryBasicInformation;
Addr: DWORD_PTR;
BytesRead: DWORD;
Buf: array of Byte;
f: TFileStream;
begin
GetSystemInfo(sysinfo);
Handle := OpenProcess(PROCESS_ALL_ACCESS, FALSE, 2928);
if Handle = 0 then
begin
err := GetLastError;
// do something...
end else
try
f := TFileStream.Create('Test.txt', fmCreate);
try
Addr := DWORD_PTR(SysInfo.lpMinimumApplicationAddress);
while (Addr < $80000000) do
begin
if VirtualQueryEx(Handle, Pointer(Addr), Mbi, SizeOf(Mbi)) = 0 then
begin
err := GetLastError;
Inc(Addr, sysinfo.dwPageSize);
Continue;
end;
if Mbi.RegionSize > Length(Buf) then
SetLength(Buf, Mbi.RegionSize);
if not ReadProcessMemory(Handle, Mbi.BaseAddress, @Buf[0], Mbi.RegionSize, BytesRead) then
begin
err := GetLastError;
// do something...
end else
f.WriteBuffer(Buf[0], BytesRead);
if Addr + Mbi.RegionSize < Addr then
break;
Addr := Addr + Mbi.RegionSize;
end;
finally
f.Free;
end;
finally
CloseHandle(Handle);
end;
Readln;
end.