Так и не нашел ответа, пришлось скачать ХЕ8 и компилировать проект на ней. Адаптировал для работы на 64 разрядной версии. Сканируется все как положено. unit SignScan;interfaceuses Windows, SysUtils, Forms, TlHelp32; function DataCompare(data: PByte; sign: PByte; mask: PAnsiChar): boolean; function GetModuleInfo(const module_name: PChar; main_process: boolean): TModuleEntry32; procedure GetPID; procedure Write(ProcessID: Cardinal; WriteAdress: int64; WriteValue: array of Byte); function ScanSignature(base: int64; size: int64; sign: PByte; mask: PAnsiChar): int64;var m_pID: int64; m_hProc: THandle; module: TModuleEntry32; m_Sign: int64; PidID, PidHandle: int64;implementationfunction GetModuleInfo(const module_name: PChar; main_process: boolean): TModuleEntry32;var snapshot: THandle; module: TModuleEntry32;begin snapshot := CreateToolhelp32Snapshot(TH32CS_SNAPMODULE, m_pID); module.dwSize := sizeof(TModuleEntry32); if (Module32First(snapshot, module)) then begin if (main_process) then begin CloseHandle(snapshot); result := module; end; while (Module32Next(snapshot, module)) do begin if (StrIComp(PChar(ExtractFileName(module.szModule)), PChar(module_name)) = 0) then begin CloseHandle(snapshot); result := module; end; end; end; result := module;end;procedure GetPID;var snapshot: THandle; pInfo: PROCESSENTRY32;begin snapshot := CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0); pInfo.dwSize := sizeof(PROCESSENTRY32); if (Process32First(snapshot, pInfo)) then begin while (Process32Next(snapshot, pInfo)) do begin if pInfo.szExeFile = procName then begin m_pID := pInfo.th32ProcessID; CloseHandle(snapshot); exit; end; end; end; m_pID := 0; CloseHandle(snapshot); exit;end;function DataCompare(data: PByte; sign: PByte; mask: PAnsiChar): boolean;begin while mask^ <> #0 do begin if ((mask^ = 'x') and (data^ <> sign^)) then begin result := false; exit; end; inc(mask); inc(data); inc(sign); end; result := true;end;function ScanSignature(base: int64; size: int64; sign: PByte; mask: PAnsiChar): int64;var mbi: MEMORY_BASIC_INFORMATION; offset: int64; buffer: PByte; BytesRead: Size_T; i: int64;begin offset := 0; while (offset < size) do begin VirtualQueryEx(m_hProc, Pointer(base + offset), &mbi, sizeof(MEMORY_BASIC_INFORMATION)); if (mbi.State <> MEM_FREE) then begin GetMem(buffer, mbi.RegionSize); ReadProcessMemory(m_hProc, mbi.BaseAddress, buffer, mbi.RegionSize, BytesRead); for i := 0 to mbi.RegionSize do begin if (DataCompare(buffer + i, sign, mask)) then begin FreeMem(buffer); result := int64(mbi.BaseAddress) + i; exit; end; end; FreeMem(buffer); end; offset := offset + mbi.RegionSize; end; result := 0;end;procedure Write(ProcessID: Cardinal; WriteAdress: int64; WriteValue: array of Byte);var pHandle:LongInt; Bytes : SIZE_T; Aob_old_Protect_OFF: dword; Aob_old_Protect_ON:dword;begin pHandle:=OpenProcess(PROCESS_VM_READ or PROCESS_VM_WRITE or PROCESS_VM_OPERATION,false,ProcessID); VirtualProtectEx(pHandle,ptr(WriteAdress),SizeOf(WriteValue),PAGE_EXECUTE_READWRITE,Aob_old_Protect_OFF); Application.ProcessMessages; WriteProcessMemory(pHandle,ptr(WriteAdress),(@WriteValue),SizeOf(WriteValue),Bytes); VirtualProtectEx(pHandle,ptr(WriteAdress),SizeOf(WriteValue),Aob_old_Protect_OFF,Aob_old_Protect_ON); CloseHandle(pHandle);end;end.