如何对其它程序所用内存检索!!

Question

最好能有实例。嘻嘻
int aa_hwnd;
IntPtr pross;
IntPtr ps;
aa_hwnd=api32.FindWindow("","");
if (aa_hwnd>0)
{
api32.GetWindowThreadProcessId(aa_hwnd,ref pross);
ps=api32.OpenProcess(api32.PROCESS_VM_READ,1,(uint)pross);
api32.MEMORY_BASIC_INFORMATION mbi=new api32.MEMORY_BASIC_INFORMATION();
api32.VirtualQueryEx(ps,(IntPtr)temp,out mbi,System.Runtime.InteropServices.Marshal.SizeOf(mbi));
}我应该如何做。。分不够我再加!!!

Answer 1

http://community.csdn.net/Expert/topic/4281/4281742.xml?temp=6.461734E-02里面的一段代码
Private Sub Button2_Click(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles Button2.Click        Dim pArray As Process() = Process.GetProcessesByName("twin")
        If pArray.Length = 0 Then
            MsgBox(GAME_WINDOW_TITLE & "没有运行")
            Exit Sub
        End If        Dim pReader As New ProcessMemoryReaderLib.ProcessMemoryReader
        pReader.ReadProcess = pArray(0)
        pReader.OpenProcess()
        Dim writeBytes As Integer        Dim buffer() As Byte = {&H39, &HC0, &H90, &H90, &H90}
        pReader.WriteProcessMemory(New IntPtr(BASE), buffer, writeBytes)
        pReader.CloseHandle()    End Sub

Answer 2

ProcessMemoryReader.cs  读写内存API封装using System;
using System.Diagnostics;
using System.Runtime.InteropServices;namespace ProcessMemoryReaderLib
{
class ProcessMemoryReaderApi
{
[Flags]
public enum ProcessAccessType
{
PROCESS_TERMINATE= (0x0001),
PROCESS_CREATE_THREAD= (0x0002), 
PROCESS_SET_SESSIONID= (0x0004), 
PROCESS_VM_OPERATION= (0x0008), 
PROCESS_VM_READ= (0x0010), 
PROCESS_VM_WRITE= (0x0020), 
PROCESS_DUP_HANDLE= (0x0040), 
PROCESS_CREATE_PROCESS= (0x0080), 
PROCESS_SET_QUOTA= (0x0100), 
PROCESS_SET_INFORMATION= (0x0200), 
PROCESS_QUERY_INFORMATION= (0x0400) 
}[DllImport("kernel32.dll")]
public static extern IntPtr OpenProcess(UInt32 dwDesiredAccess, Int32 bInheritHandle, UInt32 dwProcessId);[DllImport("kernel32.dll")]
public static extern Int32 CloseHandle(IntPtr hObject);[DllImport("kernel32.dll")]
public static extern Int32 ReadProcessMemory(IntPtr hProcess, IntPtr lpBaseAddress,[In, Out] byte[] buffer, int size, out IntPtr lpNumberOfBytesRead);[DllImport("kernel32.dll")]
public static extern Int32 WriteProcessMemory(IntPtr hProcess, IntPtr lpBaseAddress,[In, Out] byte[] buffer, int size, out IntPtr lpNumberOfBytesWritten);}public class ProcessMemoryReader
{public ProcessMemoryReader()
{
}
public Process ReadProcess
{
get
{
return m_ReadProcess;
}
set
{
m_ReadProcess = value;
}
}private Process m_ReadProcess = null;private IntPtr m_hProcess = IntPtr.Zero;public void OpenProcess()
{
//m_hProcess = ProcessMemoryReaderApi.OpenProcess(ProcessMemoryReaderApi.PROCESS_VM_READ, 1, (uint)m_ReadProcess.Id);
ProcessMemoryReaderApi.ProcessAccessType access;
access = ProcessMemoryReaderApi.ProcessAccessType.PROCESS_VM_READ 
| ProcessMemoryReaderApi.ProcessAccessType.PROCESS_VM_WRITE 
| ProcessMemoryReaderApi.ProcessAccessType.PROCESS_VM_OPERATION;
m_hProcess = ProcessMemoryReaderApi.OpenProcess((uint)access, 1, (uint)m_ReadProcess.Id);
}public void CloseHandle()
{
int iRetValue;
iRetValue = ProcessMemoryReaderApi.CloseHandle(m_hProcess);
if (iRetValue == 0)
throw new Exception("CloseHandle failed");
}public byte[] ReadProcessMemory(IntPtr MemoryAddress, int bytesToRead, out int bytesRead)
{
byte[] buffer = new byte[bytesToRead];IntPtr ptrBytesRead;
ProcessMemoryReaderApi.ReadProcessMemory(m_hProcess,MemoryAddress,buffer ,bytesToRead,out ptrBytesRead);bytesRead = ptrBytesRead.ToInt32();return buffer;
}public void WriteProcessMemory(IntPtr MemoryAddress, byte[] bytesToWrite ,out int bytesWritten)
{
IntPtr ptrBytesWritten;
ProcessMemoryReaderApi.WriteProcessMemory(m_hProcess,MemoryAddress,bytesToWrite,bytesToWrite.Length,out ptrBytesWritten);bytesWritten = ptrBytesWritten.ToInt32();
}
}
}

Answer 3

没用
刚才我没有贴全代码。要从内存中检索部分数据。
楼上的只是给出了读写内存的方法。
//api32.ReadProcessMemory(ps,temp,buffer,50,out re);
//neirong=System.Text.Encoding.Default.GetString(buffer,0,50);
关键是我怎么知道从内存的哪个地址开始读。VirtualQueryEx 这个。。还有我对mbi不是太清楚。网上的资料少的又可怜