查找内存内容
时间:2011-09-16
来源:互联网
Private Sub Command3_Click()
Dim mbi As MEMORY_BASIC_INFORMATION
Dim hwnd As Long, hProcessID As Long
Dim tmpBassAddr As Double, lBassAddr As Long
Dim BassAddr() As Long, PageSize() As Long, PageNum As Long
hwnd = FindWindow(vbNullString, Text1.Text)
If hwnd = 0 Then
MsgBox "無法找到該視窗"
Exit Sub
End If
Call GetWindowThreadProcessId(hwnd, hProcessID)
If hProcessID = 0 Then
MsgBox "無法取得ProcessID"
Exit Sub
End If
List1.Clear
List3.Clear
Text7 = hProcessID
hProcess = OpenProcess(PROCESS_ALL_ACCESS, 0, hProcessID)
If hProcess = 0 Then
MsgBox "無法開啟該Process"
Exit Sub
End If
Do While VirtualQueryEx(hProcess, ByVal lBassAddr, mbi, Len(mbi))
tmpBassAddr = mbi.BaseAddress
tmpBassAddr = tmpBassAddr + mbi.RegionSize
If tmpBassAddr > hSysInfo.lpMaximumApplicationAddress Then '預防溢位
Exit Do
End If
If mbi.State = MEM_COMMIT Then '已配置
If mbi.Protect And (PAGE_READWRITE Or PAGE_EXECUTE_READWRITE Or PAGE_EXECUTE_WRITECOPY) Then
'符合 紀錄基底位址以及區塊大小
ReDim Preserve BassAddr(PageNum)
ReDim Preserve PageSize(PageNum)
BassAddr(PageNum) = mbi.BaseAddress
PageSize(PageNum) = mbi.RegionSize
PageNum = PageNum + 1
End If
End If
lBassAddr = tmpBassAddr '對應下一筆
Loop
Dim data() As Byte, i As Long, j As Long, k As Long
Dim finded As Long, fio As Byte, buffer As Long
fio = CByte(Text6.Text)
For i = 0 To PageNum - 1
ReDim data(1 To PageSize(i))
ReadProcessMemory hProcess, ByVal BassAddr(i), data(1), PageSize(i), ByVal 0&
For j = 1 To PageSize(i)
If data(j) = fio Then
List1.AddItem Hex(BassAddr(i) + j - 1)
ReadProcessMemory hProcess, ByVal BassAddr(i) + j - 1, buffer, 4, ByVal 0&
If buffer = Text6 Then List3.AddItem BassAddr(i) + j - 1
DoEvents
finded = finded + 1
End If
Next
Next
MsgBox "執行完畢 一共找到 " & finded & "筆資料"
CloseHandle hProcess
Erase BassAddr
Erase PageSize
End Sub
这段代码可以查<=255的数值,我想实现可以查找字符和long类型,请大家帮我下
Dim mbi As MEMORY_BASIC_INFORMATION
Dim hwnd As Long, hProcessID As Long
Dim tmpBassAddr As Double, lBassAddr As Long
Dim BassAddr() As Long, PageSize() As Long, PageNum As Long
hwnd = FindWindow(vbNullString, Text1.Text)
If hwnd = 0 Then
MsgBox "無法找到該視窗"
Exit Sub
End If
Call GetWindowThreadProcessId(hwnd, hProcessID)
If hProcessID = 0 Then
MsgBox "無法取得ProcessID"
Exit Sub
End If
List1.Clear
List3.Clear
Text7 = hProcessID
hProcess = OpenProcess(PROCESS_ALL_ACCESS, 0, hProcessID)
If hProcess = 0 Then
MsgBox "無法開啟該Process"
Exit Sub
End If
Do While VirtualQueryEx(hProcess, ByVal lBassAddr, mbi, Len(mbi))
tmpBassAddr = mbi.BaseAddress
tmpBassAddr = tmpBassAddr + mbi.RegionSize
If tmpBassAddr > hSysInfo.lpMaximumApplicationAddress Then '預防溢位
Exit Do
End If
If mbi.State = MEM_COMMIT Then '已配置
If mbi.Protect And (PAGE_READWRITE Or PAGE_EXECUTE_READWRITE Or PAGE_EXECUTE_WRITECOPY) Then
'符合 紀錄基底位址以及區塊大小
ReDim Preserve BassAddr(PageNum)
ReDim Preserve PageSize(PageNum)
BassAddr(PageNum) = mbi.BaseAddress
PageSize(PageNum) = mbi.RegionSize
PageNum = PageNum + 1
End If
End If
lBassAddr = tmpBassAddr '對應下一筆
Loop
Dim data() As Byte, i As Long, j As Long, k As Long
Dim finded As Long, fio As Byte, buffer As Long
fio = CByte(Text6.Text)
For i = 0 To PageNum - 1
ReDim data(1 To PageSize(i))
ReadProcessMemory hProcess, ByVal BassAddr(i), data(1), PageSize(i), ByVal 0&
For j = 1 To PageSize(i)
If data(j) = fio Then
List1.AddItem Hex(BassAddr(i) + j - 1)
ReadProcessMemory hProcess, ByVal BassAddr(i) + j - 1, buffer, 4, ByVal 0&
If buffer = Text6 Then List3.AddItem BassAddr(i) + j - 1
DoEvents
finded = finded + 1
End If
Next
Next
MsgBox "執行完畢 一共找到 " & finded & "筆資料"
CloseHandle hProcess
Erase BassAddr
Erase PageSize
End Sub
这段代码可以查<=255的数值,我想实现可以查找字符和long类型,请大家帮我下
作者: haijun666 发布时间: 2011-09-16
一个字节的最大值就是:255,这是系统最基本的单位。能实现是完全正常的。
作者: Veron_04 发布时间: 2011-09-16
这个我知道的呀,我的意思是要实现能找字符串和长整数如用修改呀
作者: haijun666 发布时间: 2011-09-16
相关阅读 更多
热门阅读
-
office 2019专业增强版最新2021版激活秘钥/序列号/激活码推荐 附激活工具
阅读:74
-
如何安装mysql8.0
阅读:31
-
Word快速设置标题样式步骤详解
阅读:28
-
20+道必知必会的Vue面试题(附答案解析)
阅读:37
-
HTML如何制作表单
阅读:22
-
百词斩可以改天数吗?当然可以,4个步骤轻松修改天数!
阅读:31
-
ET文件格式和XLS格式文件之间如何转化?
阅读:24
-
react和vue的区别及优缺点是什么
阅读:121
-
支付宝人脸识别如何关闭?
阅读:21
-
腾讯微云怎么修改照片或视频备份路径?
阅读:28