vb.net Process string memory address

[vbmem]

I'm developing a virus detection program.

When the process restarts, the address of the memory changes.

Is there a way to find the address of memory if the value of string is 'virus'?

Or can I use Array of Byte to get the address of the memory?

If you know, please let me know about the project or related materials.

The code I use is below.

The maddress part changes continuously when restarted.

Dim virusbool As Boolean = False


Dim maddress As Integer = &H24AC6BA

Dim vProcess As Process = Process.GetProcessesByName("test")(0)

pid = vProcess.Id

Dim processHandle As IntPtr = OpenProcess(PROCESS_WM_READ, False, vProcess.Id)

Dim bytesRead As Integer = 0

Dim buffer As Byte() = New Byte(14) {}

ReadProcessMemory(CInt(processHandle), maddress, buffer, buffer.Length, bytesRead)



If Encoding.Unicode.GetString(buffer).Contains("virus") Then

virusbool = True

Else

virusbool = False

End If

Continue reading...