windows 内存搜索

野性酷女 2022-08-20 14:17 153阅读 0赞

\#include <Windows.h>  
  
BOOL FindFirst(DWORD dwValue);  
BOOL FindNext(DWORD dwValue);  
HANDLE g\_hProcess;  
DWORD g\_arList\[1024\];  
DWORD g\_nListCnt;  
  
BOOL CompareAPage(DWORD dwBaseAddr, DWORD dwValue)  
\{  
//读取一页内存  
BYTE arBytes\[4096\];  
BOOL bRead = ::ReadProcessMemory(g\_hProcess, (LPVOID)dwBaseAddr, arBytes, 4096,NULL);  
if (bRead == FALSE)  
\{  
return FALSE;  
\}  
DWORD \*pdw;  
for (int i=0;i<4096-4;i++)  
\{  
  
pdw = (DWORD\*)&arBytes\[i\];  
if (pdw\[0\] == dwValue)  
\{  
g\_arList\[g\_nListCnt++\] = dwBaseAddr+i;  
\}  
/\*出错，应该将地址先转换成DWORD\*,即指向DWORD的地址，然后再取\[0\]  
if ((DWORD)&arBytes\[i\] == dwValue)  
\{  
g\_arList\[g\_nListCnt++\] = dwBaseAddr+i;  
\}  
\*/  
\}  
if (g\_nListCnt > 1024)  
\{  
printf("the position is large than 1024..");  
return FALSE;  
\}  
return TRUE;  
\}  
  
BOOL FindFirst(DWORD dwValue)  
\{  
const DWORD dwOneGB = 1 \* 1024 \*1024 \*1024; // 1GB  
const DWORD dwOnePage = 4\* 1024; // 4K  
DWORD dwBase;  
OSVERSIONINFO versionInfo=\{0\};  
versionInfo.dwOSVersionInfoSize = sizeof(OSVERSIONINFO);  
  
::GetVersionEx(&versionInfo);  
if (versionInfo.dwPlatformId == VER\_PLATFORM\_WIN32\_WINDOWS ) //win98  
\{  
dwBase = 4 \* 1024 \*1024; // 4MB  
\}  
else  
\{  
dwBase = 64 \* 1024; // 64KB  
\}  
//从开始地址到2GB的空间查找  
for (;dwBase<2\*dwOneGB;dwBase+=dwOnePage)  
\{  
CompareAPage(dwBase,dwValue);  
\}  
return TRUE;  
\}  
  
BOOL FindNext(DWORD dwValue)  
\{  
DWORD dwOriCnt = g\_nListCnt;  
DWORD dwReadValue;  
BOOL bRet = FALSE;  
  
g\_nListCnt = 0;  
for (int i=0;i<dwOriCnt;i++)  
\{  
if (::ReadProcessMemory(g\_hProcess,(LPVOID)g\_arList\[i\],&dwReadValue,sizeof(DWORD),0))  
\{  
if (dwReadValue == dwValue)  
\{  
g\_arList\[g\_nListCnt++\] = g\_arList\[i\];  
bRet = TRUE;  
\}  
\}  
\}  
return bRet;  
\}  
  
void ShowList()  
\{  
for (int i=0;i<g\_nListCnt;i++)  
\{  
printf("%08lX\\n", g\_arList\[i\]);  
\}  
\}  
BOOL WriteMemory(DWORD dwAddr, DWORD dwValue)  
\{  
//出错的情况：写入的是&dwValue，而不是（LPVOID）dwValue  
return WriteProcessMemory(g\_hProcess,(LPVOID)dwAddr,&dwValue,sizeof(DWORD),NULL);  
\}  
int \_tmain(int argc, \_TCHAR\* argv\[\])  
\{  
g\_nListCnt = 0;  
memset(g\_arList,0,sizeof(g\_arList));  
  
char szCommandLine\[\]="c:\\\\testor.exe";  
STARTUPINFO si=\{sizeof(STARTUPINFO)\};  
si.dwFlags = STARTF\_USESHOWWINDOW;  
si.wShowWindow = TRUE;  
  
PROCESS\_INFORMATION pi;  
BOOL bRet = CreateProcess(NULL, szCommandLine,NULL,NULL,FALSE,CREATE\_NEW\_CONSOLE,NULL,NULL,&si,&pi);  
if (bRet == FALSE)  
\{  
printf("createProcess failed...");  
return -1;  
\}  
::CloseHandle(pi.hThread);  
g\_hProcess = pi.hProcess;  
//输入修改值  
int iVal;  
printf("Input iVal=");  
scanf("%d", &iVal);  
//进行第一次查找  
FindFirst(iVal);  
//打印结果  
ShowList();  
  
//再次查找  
while (g\_nListCnt > 1)  
\{  
printf("input iVal:\\n");  
scanf("%d",&iVal);  
FindNext(iVal);  
ShowList();  
\}  
  
//修改值  
printf("input new value:\\n");  
scanf("%d",&iVal);  
if (WriteMemory(g\_arList\[0\],iVal))  
\{  
printf("write suc...");  
\}  
  
::CloseHandle(g\_hProcess);  
return 0;  
\}