var
Form1: TForm1;
canberead:MEMORY_BASIC_INFORMATION;
SystemInfo: SYSTEM_INFO;
startaddress,endaddress,eaddress:dword;
PageSize:cardinal;
temp:dword;
data:Array[0..004000] of dword;
scan:integer;
PidHandle:Thandle;
PidID : integer;
Const
ProgramName='PINBALL.EXE';

function GetProcessID(Const ExeFileName: string; var ProcessId: integer): boolean;

implementation

{$R *.dfm}

function GetProcessID(Const ExeFileName: string; var ProcessId: integer): boolean;
var
ContinueLoop: BOOL;
FSnapshotHandle: THandle;
FProcessEntry32: TProcessEntry32;
begin
result := false;
FSnapshotHandle := CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
FProcessEntry32.dwSize := Sizeof(FProcessEntry32);
ContinueLoop := Process32First(FSnapshotHandle, FProcessEntry32);
while integer(ContinueLoop) <> 0 do begin
if (StrIComp(PChar(ExtractFileName(FProcessEntry32.szExeFile)), PChar(ExeFileName)) = 0)
or (StrIComp(FProcessEntry32.szExeFile, PChar(ExeFileName)) = 0) then begin
ProcessId:= FProcessEntry32.th32ProcessID;
result := true;
break;
end;
ContinueLoop := Process32Next(FSnapshotHandle, FProcessEntry32);
end;
CloseHandle(FSnapshotHandle);
end;

procedure TForm1.Button1Click(Sender: TObject);
begin
if GetProcessID(ProgramName, PidId) then
begin
startaddress:=($00400000);
endaddress:=($7FFFFFFF);
eaddress:=startaddress;
GetSystemInfo(SystemInfo);
PageSize:=Systeminfo.dwPageSize;
scan:=0;
PidHandle := OpenProcess(PROCESS_ALL_ACCESS,False,PidId);
repeat
if ReadProcessMemory(PidHandle, Pointer(eaddress),@data,PageSize,temp)=false then
begin
Virtualqueryex(PidHandle,pointer(eaddress),canberead,PageSize);
ReadProcessMemory(PidHandle, Pointer(canberead.BaseAddress),@data,canberead.RegionSize,temp);
end;
repeat
if data[scan]=strtoint(value.Text) then
begin
Foundlist2.InsertRow(inttostr(scan+eaddress),Edit1.Text,true);
end;
scan:=scan+1;
until scan=PageSize+1;
until eaddress=endaddress+1;

end;

end;
end;

if data[scan]=strtoint(value.Text) then

Foundlist2.InsertRow(inttostr(scan+eaddress),Edit1.Text,true);