windows编程之内存数据修改

关注

原创最新推荐文章于 2026-05-04 10:15:32 发布 894 阅读 AI 写同款· GEO 优化 ›

游戏内存修改器实现原理修改游戏中显示的数据就是要修改游戏所在进程的内存，因为这些数据都在内存中保留着。由于进程的地址空间是相互隔离的，所以必须有 API 函数的协助才能访问其他进程的内存。通常使用下面两个函数对其他进程的内存空间进行读写操作。 BOOL ReadProcessMemory( HANDLE hProcess, //待读进程的句柄 LPCVOID lpBaseAddress, //目标进程中待读内存的起始地址 LPVOID lpBuffer, //用来接受读取数据的缓冲区 DWOR 阅读详情

#include"StdAfx.h"
#include<windows.h>

DWORD g_arList[1024];
int g_nListCnt=0;
HANDLE g_hProcess;

BOOL CompareAPage(DWORD dwBaseAddr,DWORD dwValue){
    BYTE arBytes[4096];
    if(!::ReadProcessMemory(g_hProcess,(LPVOID)dwBaseAddr,arBytes,4096,NULL))
        return FALSE;
    DWORD* pwd;
    for(int i=0;i<(int)1024*4-3;i++){
        pwd=(DWORD*)&arBytes[i];
        if(pwd[0]==dwValue){
            if(g_nListCnt>1024)
                return FALSE;
            g_arList[g_nListCnt++]=dwBaseAddr+i;
        }
    }
    return TRUE;
}

BOOL FindFirst(DWORD dwValue){
    const DWORD dwOneGB=1024*1024*1024;
    const DWORD dwOnePage=4*1024;
    if(g_hProcess==NULL)
        return FALSE;
    DWORD dwBase;
    OSVERSIONINFO vi={sizeof(vi)};
    ::GetVersionEx(&vi);
    if(vi.dwPlatformId=VER_PLATFORM_WIN32_WINDOWS)
        dwBase=4*1024*1024;
    else
        dwBase=640*1024;
    for(;dwBase<2*dwOneGB;dwBase+=dwOnePage)
        CompareAPage(dwBase,dwValue);
    return TRUE;
}

BOOL FindNext(DWORD dwValue){
    int i=0;
    int nOrgCnt=g_nListCnt;
    g_nListCnt=0;
    BOOL bRet=FALSE;
    DWORD dwReadValue;
    for(i=0;i<nOrgCnt;i++){
        if(::ReadProcessMemory(g_hProcess,(LPVOID)g_arList[i],&dwReadValue,sizeof(DWORD),NULL)){
            if(dwReadValue==dwValue){
                g_arList[g_nListCnt++]=g_arList[i];
                bRet=TRUE;
            }
        }
    }
    return     TRUE;
}

BOOL WriteMemory(DWORD dwAddr,DWORD dwValue){
    return ::WriteProcessMemory(g_hProcess,(LPVOID)dwAddr,&dwValue,sizeof(DWORD),NULL);
}

void ShowList(){
    for(int i=0;i<g_nListCnt;i++)
        printf("%081X/n",g_arList[i]);
}

int main(int argc,char* argv[])
{
    //启动进程
    char szFileName[30];
    printf("The exe_file name is:");
    scanf("%s",szFileName);
    STARTUPINFO si={sizeof(si)};
    PROCESS_INFORMATION pi;
    ::CreateProcess(NULL,szFileName,NULL,NULL,FALSE,CREATE_NEW_CONSOLE,NULL,NULL,&si,&pi);
    //关闭线程句柄,只用到进程句柄
    ::CloseHandle(pi.hThread);
    g_hProcess=pi.hProcess;
    //输入要修改的值
    int iVal;
    printf("Input val= ");
    scanf("%d",&iVal);
    FindFirst(iVal);
    ShowList();
    printf("g_nListCnt= %d/n//////////////////////////n/n",g_nListCnt);
    while(g_nListCnt>1){
        printf("Input val=");
        scanf("%d",&iVal);
        FindNext(iVal);
        ShowList();
        if(g_nListCnt==0)
            printf("Not any address in g_nList!/n");
        printf("g_nListCnt= %d/n//////////////////////////////n/n",g_nListCnt);
    }
    printf("iVal=    %d/n",iVal);
    printf("New Value=    ");
    scanf("%d",&iVal);
    WriteMemory(g_arList[0],iVal);
    ::CloseHandle(g_hProcess);
    printf("Operation Successful!/n/n");
    return 0;
}