File tree Expand file tree Collapse file tree 2 files changed +3
-2
lines changed
Expand file tree Collapse file tree 2 files changed +3
-2
lines changed Original file line number Diff line number Diff line change @@ -57,7 +57,7 @@ class MemoryProtectionsEnum(Enum):
5757 PAGE_READWRITE = 0x04
5858
5959 # Indicates memory page is readable. (Custom constant)
60- PAGE_READABLE = PAGE_EXECUTE_READ | PAGE_EXECUTE_READWRITE | PAGE_READWRITE
60+ PAGE_READABLE = PAGE_EXECUTE_READ | PAGE_EXECUTE_READWRITE | PAGE_READWRITE | PAGE_READONLY
6161
6262 # Indicates memory page is readable and writeable. (Custom constant)
6363 PAGE_READWRITEABLE = PAGE_EXECUTE_READWRITE | PAGE_READWRITE
Original file line number Diff line number Diff line change @@ -174,7 +174,8 @@ def SearchAddressesByValue(
174174
175175 # Only committed, non-shared and readable memory pages.
176176 if region ["struct" ].State != MemoryAllocationStatesEnum .MEM_COMMIT .value : continue
177- if region ["struct" ].Type != MemoryTypesEnum .MEM_PRIVATE .value : continue
177+ if (region ["struct" ].Type != MemoryTypesEnum .MEM_PRIVATE .value and
178+ region ["struct" ].Type != MemoryTypesEnum .MEM_IMAGE .value ): continue
178179 if region ["struct" ].Protect & MemoryProtectionsEnum .PAGE_READABLE .value == 0 : continue
179180
180181 # If writeable_only is True, checks if the memory page is writeable.
You can’t perform that action at this time.
0 commit comments