VB操作内存类

Private Declare Function ReadProcessMemory Lib "kernel32.dll" (ByVal hProcess As Long, ByRef lpBaseAddress As Any, ByRef lpBuffer As Any, ByVal nSize As Long, ByRef lpNumberOfBytesWritten As Long) As Long
Private Declare Function WriteProcessMemory Lib "kernel32.dll" (ByVal hProcess As Long, ByRef lpBaseAddress As Any, ByRef lpBuffer As Any, ByVal nSize As Long, ByRef lpNumberOfBytesWritten As Long) As Long
Private Declare Function VirtualProtect Lib "kernel32" (ByRef lpAddress As Any, ByVal dwSize As Long, ByVal flNewProtect As Long, lpflOldProtect As Long) As Long '设置内存可读写
Private Const PAGE_EXECUTE_READWRITE = &H40 ' PAGE_EXECUTE_READWRITE  表示可读可写
Private Declare Function VirtualQueryEx Lib "kernel32" (ByVal hProcess As Long, ByVal lpAddress As Long, lpBuffer As MEMORY_BASIC_INFORMATION, ByVal dwLength As Long) As Long '搜索内存
Private Type MEMORY_BASIC_INFORMATION
    BaseAddress As Long
    AllocationBase As Long
    AllocationProtect As Long
    RegionSize As Long
    State As Long
    Protect As Long
    lType As Long
End Type

Private Declare Sub CopyMemory Lib "kernel32" Alias "RtlMoveMemory" (Destination As Any, Source As Any, ByVal Length As Long)
Private Const PROCESS_ALL_ACCESS = &H1F0FFF

'设置内存属性,1可读写，其他恢复原样
Function SetMem(ByVal addr As String, ByVal lens As Integer, Optional Stype As Integer = 1)
    Select Case Stype
        Case 1:
            VirtualProtect ByVal addr, lens, PAGE_EXECUTE_READWRITE, OldProtect '修改内存属性
        Case Else:
            VirtualProtect ByVal addr, lens, OldProtect, OldProtect '恢复内存属性
    End Select
End Function

'搜索内存(句柄,开始地址,结束地址,比较方式,搜索类型)  比较方式:1精确数值 2大于 3小于 4两数之间 搜索类型:0 16进制,1 1字节整数,2 2字节整数,3 4字节整数, 4 4字节浮点数
Function SearchMem(ByVal mhwnd As Long, ByVal svalue As String, Optional beginaddr As String = "&H400000", Optional endaddr As String = "&H7FFFFFFF", Optional SearchStyle As Integer = 1, Optional Stype As Integer = 3) As String

    Const PAGE_READWRITE = 4, MEM_COMMIT = &H1000
    Dim i As Long, j As Long, count As Long
    Dim r As Long, mbi As MEMORY_BASIC_INFORMATION
    Dim lpAddress As Long: lpAddress = beginaddr
    Dim bSearch() As Byte
    Dim ubs As Long
    Dim kx  As Long
    bSearching = True
    nCountX = 0
    r = VirtualQueryEx(mhwnd, lpAddress, mbi, Len(mbi))
    
    '将7FFFFFFF作为搜索结束地址
    Dim lpBuffer() As Byte
    
    '字符串转数组
    Dim sp() As String
    Dim tmp As Long
    Dim nLength As Long
    '搜索支持数据串,每个数据用逗号分开,如123,234,5,9
    sp = Split(svalue, ",")
    nLength = UBound(sp)
    
    If Stype = 0 Then sp(0) = CLng("&H" & svalue)
    
    If Stype = 1 Then '  1字节
        ReDim bSearch(nLength)
        For i = 0 To nLength
            bSearch(i) = Val(sp(i)) And &HFF '防止溢出错误
        Next
    ElseIf Stype = 2 Then ' 2字节
        ReDim bSearch((nLength + 1) * 2 - 1)
        For i = 0 To nLength
            tmp = Val(sp(i))
            CopyMemory bSearch(i * 2), tmp, 2
        Next
    ElseIf Stype = 3 Then ' 4字节
        ReDim bSearch((nLength + 1) * 4 - 1)
        For i = 0 To nLength
            tmp = Val(sp(i))
            CopyMemory bSearch(i * 4), tmp, 4
        Next
    Else
        ReDim bSearch((nLength + 1) * 4 - 1)
        Dim tmp_f As Single
        For i = 0 To nLength
            tmp_f = CSng(sp(i))
            CopyMemory bSearch(i * 4), tmp_f, 4
        Next
    End If
    
    ubs = UBound(bSearch)
    
    If SearchStyle = 1 Then
        Do While (r And (lpAddress < CLng(endaddr)) And bSearching)
            '只搜索可读取的已提交的内存区域
            If (mbi.Protect And PAGE_READWRITE) And (mbi.State = MEM_COMMIT) Then
                ReDim lpBuffer(mbi.RegionSize - 1)
                ReadProcessMemory mhwnd, ByVal mbi.BaseAddress, lpBuffer(0), mbi.RegionSize, 0&
                For i = 0 To mbi.RegionSize - 1 - ubs '防止越界
                    '逐个字节比较,如果有任何一个不相等,则不再比较其它
                    For j = 0 To ubs
                        If bSearch(j) <> lpBuffer(i + j) Then GoTo a10
                    Next
                    nCountX = nCountX + 1
                    SearchMem = SearchMem & Hex(i + lpAddress) & "|"
a10:
                Next
            End If
            lpAddress = lpAddress + mbi.RegionSize '搜索下一条
            r = VirtualQueryEx(mhwnd, lpAddress, mbi, Len(mbi))
        Loop
    End If
    
    If SearchStyle = 2 Then
        Do While (r And (lpAddress < CLng(endaddr)) And bSearching)
            '只搜索可读取的已提交的内存区域
            If (mbi.Protect And PAGE_READWRITE) And (mbi.State = MEM_COMMIT) Then
                
                ReDim lpBuffer(mbi.RegionSize - 1)
                
                ReadProcessMemory mhwnd, ByVal mbi.BaseAddress, lpBuffer(0), mbi.RegionSize, 0&
                
                For i = 0 To mbi.RegionSize - 1 - ubs '防止越界
                    
                    '逐个字节比较,如果有任何一个不相等,则不再比较其它
                    For j = 0 To ubs
                        If bSearch(j) <= lpBuffer(i + j) Then GoTo b10
                    Next
                    nCountX = nCountX + 1
                    SearchMem = SearchMem & Hex(i + lpAddress) & "|"
b10:
                Next
            End If
            lpAddress &#