aProcess := process('Notepad.exe');
aModule := aProcess.MainModule;
BytesToRead:= ?? //Need to find size of Notepad in memory
GetMem (ReadBuff, BytesToRead); //Allocate buf for all bytes
GlobalLock ( ?? ) //How to protect readed memory
aProcess.ReadMemory (aModule.Memory, ReadBuff, BytesToRead); // Can I use this?
Are you sure that this array is part of the DLL/EXE image in RAM? Or maybe it's an allocated array? If it's allocated, it could be *anywhere*. You'd have to read the whole RAM area of the target process to find it.
I am searching a code sequece in process memory. That sequence is located version from version at different place.
Wildcards are jmp addresses in code. So my idea is read code from memory to another allocated place and do the search here. I noticed you have public IProcess.ReadMemory function so I am interesting if it is some way better than Windows.ReadProcessMemory.
Yeah, ReadProcessMemory or IProcess.ReadMemory are the best way. Well, another way would be to inject a dll into the target process. But I think ReadProcessMemory is less obtrusive.