+ -
当前位置:首页 → 问答吧 → ReadProcessMemory内存读取

ReadProcessMemory内存读取

时间:2011-07-24

来源:互联网

请问ReadProcessMemory这个函数该怎样读取指定内存地址中的值呢。在网上找了N久,头都大了,特来请教。

目标程序01是我自己编写的一个窗体程序,然后我在空白地址 &H401E46 写入了一些字符串,用内存写入没问题,读取的却不一样。
觉得奇怪的是为什么进程id会一直变动的pHandle。读出的&H401E46的内存也是一直变动的,鼠标移动到窗体不同地方也会变化(不正确)。
请问怎样才能读取到的内容和写入的时候一样呢。
窗体中的
00401E46的十六进制数据是 DC D9 06 0B 7C 7B
用下面方法读取到的却是一些变动的数字。

下面是读取的代码
VB code

Private Declare Function WriteProcessMemory Lib "kernel32" (ByVal hProcess As Long, ByVal lpBaseAddress As Any, lpBuffer As Any, ByVal nSize As Long, lpNumberOfBytesWritten As Long) As Long
Private Declare Function FindWindow Lib "user32" Alias "FindWindowA" (ByVal lpClassName As String, ByVal lpWindowName As String) As Long
Private Declare Function GetWindowThreadProcessId Lib "user32" (ByVal hwnd As Long, lpdwProcessId As Long) As Long
Private Declare Function OpenProcess Lib "kernel32" (ByVal dwDesiredAccess As Long, ByVal bInheritHandle As Long, ByVal dwProcessId As Long) As Long
Private Declare Function ReadProcessMemory Lib "kernel32" (ByVal hProcess As Long, lpBaseAddress As Any, lpBuffer As Any, ByVal nSize As Long, lpNumberOfBytesWritten As Long) As Long
Private Declare Function CloseHandle Lib "kernel32" (ByVal hObject As Long) As Long

Private Const PROCESS_ALL_ACCESS = &H1F0FFF

Dim hwnd1 As Long
Dim pid As Long
Dim pHandle As Long

Private Function ncnr(lpADDress As Long) As Integer
    hwnd1 = FindWindow(vbNullString, "01") 
    GetWindowThreadProcessId hwnd1, pid
    pHandle = OpenProcess(PROCESS_ALL_ACCESS, False, pid)
    ReadProcessMemory pHandle, lpADDress, ByVal VarPtr(ncnr), 6, 0&
    CloseHandle pHandle
End Function
Private Sub Timer1_Timer()
    hwnd1 = FindWindow(vbNullString, "01")
    If hwnd1 = 0 Then
        Label1.Caption = "程序未运行"
        Text1.Text=""
    Else
        Label1.Caption = "程序已运行"
        Text1.Text = ncnr(&H401E46)
    End If
End Sub

作者: y564642865   发布时间: 2011-07-24

我的帖子呢???

作者: y564642865   发布时间: 2011-07-24