Jump to content

Recommended Posts

Posted

One of my friends is running a script that is behaving bizarrely slow.  Same thing works fine on many other computers and I suspect it's some kind of configuration error but I'm not sure what it could be.  Are there any known compatibility settings or windows configuration things that causes AutoIt to run much slower than it should?

-jasty

Posted (edited)

It's a plugin I made that uses NomadMemory.au3 to read / write to the memory of another process and can create remote threads and wait for them to finish.  This is the thread code.   Must be some big delay in spinning up the remote thread?

This is the injection code.

Func InjectCode($OPcode, $processHandle)
    ;Allocate memory for the OpCode and retrieve address for this
    $functionAddress = DllCall('kernel32.dll', 'int', 'VirtualAllocEx', 'int', $processHandle, 'ptr', 0, 'int', 100, 'int', 0x1000, 'int', 0x40)
        ;Construct the OpCode for calling the function
        ;Put the OpCode into a struct for later memory writing
    $vBuffer = DllStructCreate('byte[' & StringLen($OPcode) / 2 & ']')
    For $loop = 1 To DllStructGetSize($vBuffer)
        DllStructSetData($vBuffer, 1, Dec(StringMid($OPcode, ($loop - 1) * 2 + 1, 2)), $loop)
    Next
        ;Write the OpCode to previously allocated memory
    DllCall('kernel32.dll', 'int', 'WriteProcessMemory', 'int', $processHandle, 'int', $functionAddress[0], 'int', DllStructGetPtr($vBuffer), 'int', DllStructGetSize($vBuffer), 'int', 0)
        ;Create a remote thread in order to run the OpCode
    $hRemoteThread = DllCall('kernel32.dll', 'int', 'CreateRemoteThread', 'int', $processHandle, 'int', 0, 'int', 0, 'int', $functionAddress[0], 'ptr', 0, 'int', 0, 'int', 0)
        ;Wait for the remote thread to finish
    DllCall('kernel32.dll', 'int', 'WaitForSingleObject', 'int', $hRemoteThread[0], 'int', 0xFFFFFFFF)
        ;Close the handle to the previously created remote thread
    DllCall('kernel32.dll', 'int', 'CloseHandle', 'int', $hRemoteThread[0])
        ;Free the previously allocated memory
    DllCall('kernel32.dll', 'ptr', 'VirtualFreeEx', 'hwnd', $processHandle, 'int', $functionAddress[0], 'int', 0, 'int', 0x8000)
EndFunc
Edited by jasty
Posted
4 hours ago, jasty said:

Must be some big delay in spinning up the remote thread?

Do we get to know how big the delay is besides “bizarrely slow” ?

If it’s more than an hour, then I’m interested :)

Code hard, but don’t hard code...

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...