读取任意进程内存

最新推荐文章于 2023-09-25 09:00:58 发布

nullptr__

最新推荐文章于 2023-09-25 09:00:58 发布

阅读量3.6k

点赞数 1

CC 4.0 BY-SA版权

分类专栏：研究文章标签：进程内存读取

本文链接：https://blog.youkuaiyun.com/kingpharaoh/article/details/48223237

研究专栏收录该内容

7 篇文章

订阅专栏

用进程快照信息找到进程，打开后读取内存，没什么技术含量。。

void CReadMemDlg::OnBtnRead() 
{
	UpdateData();
	void *nAddr;
	UINT nLen;
	sscanf(m_strAddr,"%x",&nAddr);
	sscanf(m_strLen,"%x",&nLen);

	HANDLE hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPALL,0);
	if(hSnapshot == NULL) {
		AfxMessageBox("无法创建进程快照！");
		return;
	}
	PROCESSENTRY32 entry;
	entry.dwSize = sizeof(entry);
	BOOL bOK = Process32First(hSnapshot,&entry);
	DWORD id = 0;
	while(bOK) {
		if(entry.szExeFile == m_strProc) {
			id = entry.th32ProcessID;
			break;
		}
		bOK = Process32Next(hSnapshot,&entry);
	}
	CloseHandle(hSnapshot);
	if(!bOK) {
		AfxMessageBox("无法找到进程！");
		return;
	}
	HANDLE hProc = OpenProcess(PROCESS_ALL_ACCESS,FALSE,id);
	if(hProc == 0) {
		AfxMessageBox("无法打开进程！");
		return;
	}
	BYTE *pBuf = new BYTE[nLen];
	if(!ReadProcessMemory(hProc,nAddr,pBuf,nLen,NULL)) {
		AfxMessageBox("无法读取内存！");
		CloseHandle(hProc);
		return;
	}
	CloseHandle(hProc);
	m_strRes.Empty();
	for(int i=0;i<nLen;++i) {
		CString str;
		str.Format((i != nLen-1)? "%02X ": "%02X", UINT(pBuf[i]));
		m_strRes+=str;
	}
	UpdateData(FALSE);
}