http://www.jarloo.com/reading-and-writing-to-memory/

Declarations

[Flags]
public enum ProcessAccessFlags : uint
{
All = 0x001F0FFF,
Terminate = 0x00000001,
CreateThread = 0x00000002,
VMOperation = 0x00000008,
VMRead = 0x00000010,
VMWrite = 0x00000020,
DupHandle = 0x00000040,
SetInformation = 0x00000200,
QueryInformation = 0x00000400,
Synchronize = 0x00100000
} [DllImport("kernel32.dll")]
private static extern IntPtr OpenProcess(ProcessAccessFlags dwDesiredAccess, [MarshalAs(UnmanagedType.Bool)] bool bInheritHandle, int dwProcessId); [DllImport("kernel32.dll", SetLastError = true)]
private static extern bool WriteProcessMemory(IntPtr hProcess, IntPtr lpBaseAddress, byte[] lpBuffer, uint nSize, out int lpNumberOfBytesWritten); [DllImport("kernel32.dll", SetLastError = true)]
static extern bool ReadProcessMemory(IntPtr hProcess, IntPtr lpBaseAddress, [Out] byte[] lpBuffer, int dwSize, out int lpNumberOfBytesRead); [DllImport("kernel32.dll")]
public static extern Int32 CloseHandle(IntPtr hProcess);

Reading from another processes Memory

public static byte[] ReadMemory(Process process, int address, int numOfBytes, out int bytesRead)
{
IntPtr hProc = OpenProcess(ProcessAccessFlags.All, false, process.Id); byte[] buffer = new byte[numOfBytes]; ReadProcessMemory(hProc, new IntPtr(address), buffer, numOfBytes, out bytesRead);
return buffer;
}

Here is an example of a call to this function:

Process process = Process.GetProcessesByName("My Apps Name").FirstOrDefault();
int address = 0x02ED2910; int bytesRead;
byte[] value = ReadMemory(process, address, , out bytesRead);

Writing to another processes memory

public static bool WriteMemory(Process process, int address, long value, out int bytesWritten)
{
IntPtr hProc = OpenProcess(ProcessAccessFlags.All, false, process.Id); byte[] val = BitConverter.GetBytes(value); bool worked = WriteProcessMemory(hProc, new IntPtr(address), val, (UInt32) val.LongLength, out bytesWritten); CloseHandle(hProc); return worked;
}

Here is an example of a call to this function:

Process process = Process.GetProcessesByName("My Apps Name").FirstOrDefault();          
int address = 0x02ED2910;
 
int bytesWritten;
bool worked = WriteMemory(process, address, value, out bytesWritten);
 
Readprocessmemory用法

函数功能:该函数从指定的进程中读入内存信息,被读取的区域必须具有访问权限。

函数原型:BOOL ReadProcessMemory(HANDLE hProcess,LPCVOID lpBaseAddress,LPVOID lpBuffer,DWORD nSize,LPDWORD lpNumberOfBytesRead);

参数:

hProcess:进程句柄

lpBaseAddress:读出数据的地址

lpBuffer:存放读取数据的地址

nSize:读出的数据大小

lpNumberOfBytesRead:数据的实际大小

C#中使用该函数首先导入命名空间:

  1. using System.Runtime.InteropServices;

using System.Runtime.InteropServices;

然后写API引用部分的代码,放入 class 内部

  1. [DllImport("kernel32.dll ")]
  2. static extern bool ReadProcessMemory(int hProcess, int lpBaseAddress,out int lpBuffer, int nSize, out int lpNumberOfBytesRead);

[DllImport("kernel32.dll ")]
static extern bool ReadProcessMemory(int hProcess, int lpBaseAddress,out int lpBuffer, int nSize, out int lpNumberOfBytesRead);

这个函数有五个参数,第一个参数是 进程句柄,由OpenProcess函数获取;第二个参数是要读出数据的地址,使用CE等辅助工具可取得;第三个参数是用于存放读取数据的地址;第四个参数是 要读出的数据大小;第五个参数是读出数据的实际大小。例如:

  1. IntPtr hwnd = FindWindow(null, "计算器");
  2. const int PROCESS_ALL_ACCESS = 0x1F0FFF;
  3. const int PROCESS_VM_READ = 0x0010;
  4. const int PROCESS_VM_WRITE = 0x0020;
  5. if (hwnd != IntPtr.Zero)
  6. {
  7. int calcID;
  8. int calcProcess;
  9. int dataAddress;
  10. int readByte;
  11. GetWindowThreadProcessId(hwnd, out calcID);
  12. calcProcess = OpenProcess(PROCESS_VM_READ | PROCESS_VM_WRITE, false, calcID);
  13. //假设地址0X0047C9D4存在信息
  14. ReadProcessMemory(calcProcess, 0X0047C9D4, out dataAddress, 4, out readByte);
  15. MessageBox.Show(dataAddress.ToString());
  16. }
  17. else
  18. {
  19. MessageBox.Show("没有找到窗口");
  20. }

IntPtr hwnd = FindWindow(null, "计算器");
const int PROCESS_ALL_ACCESS = 0x1F0FFF;
const int PROCESS_VM_READ = 0x0010;
const int PROCESS_VM_WRITE = 0x0020;
if (hwnd != IntPtr.Zero)
{
int calcID;
int calcProcess;
int dataAddress;
int readByte;
GetWindowThreadProcessId(hwnd, out calcID);
calcProcess = OpenProcess(PROCESS_VM_READ | PROCESS_VM_WRITE, false, calcID);
//假设地址0X0047C9D4存在信息
ReadProcessMemory(calcProcess, 0X0047C9D4, out dataAddress, 4, out readByte);
MessageBox.Show(dataAddress.ToString());
}
else
{
MessageBox.Show("没有找到窗口");
}

如果我们读取的一段内存中的数据,我们引入部分可修改成如下:

  1. //二维数组
  2. [DllImport("kernel32.dll ")]
  3. static extern bool ReadProcessMemory(int hProcess, int lpBaseAddress, byte[,] lpBuffer, int nSize, out int lpNumberOfBytesRead);
  4. //一维数组
  5. [DllImport("kernel32.dll ")]
  6. static extern bool ReadProcessMemory(int hProcess, int lpBaseAddress, byte[] lpBuffer, int nSize, out int lpNumberOfBytesRead);

//二维数组
[DllImport("kernel32.dll ")]
static extern bool ReadProcessMemory(int hProcess, int lpBaseAddress, byte[,] lpBuffer, int nSize, out int lpNumberOfBytesRead);
//一维数组
[DllImport("kernel32.dll ")]
static extern bool ReadProcessMemory(int hProcess, int lpBaseAddress, byte[] lpBuffer, int nSize, out int lpNumberOfBytesRead);

由于数组是引用传递,我们不需要写out关键字。

Reading or Writing to Another Processes Memory in C# z的更多相关文章

  1. Reading and Writing CSV Files in C#

    Introduction A common requirement is to have applications share data with other programs. Although t ...

  2. Reading and writing RData files

    前面添加个lapply()或者dplyr::llply()就能读取,储存多个文件了.http://bluemountaincapital.github.io/FSharpRProvider/readi ...

  3. Reading and writing

    A text file is a sequence of characters stored on a permanent medium like a hard drive, flash memory ...

  4. Analysis about different methods for reading and writing file in Java language

    referee:Java Programming Tutorial Advanced Input & Output (I/O) JDK 1.4+ introduced the so-calle ...

  5. Apache POI – Reading and Writing Excel file in Java

    来源于:https://www.mkyong.com/java/apache-poi-reading-and-writing-excel-file-in-java/ In this article, ...

  6. PostgreSQL Reading Ad Writing Files、Execution System Instructions Vul

    catalog . postgresql简介 . 文件读取/写入 . 命令执行 . 影响范围 . 恶意代码分析 . 缓解方案 1. postgresql简介 PostgreSQL 是一个自由的对象-关 ...

  7. 【转】Native Thread for Win32 C- Creating Processes(通俗易懂,非常好)

    http://www.bogotobogo.com/cplusplus/multithreading_win32C.php To create a new process, we need to ca ...

  8. five kinds of IPC methods

    Shared memory permits processes to communicate by simply reading and writing to a specified memory l ...

  9. Android Security

    Android Security¶ 确认签名¶ Debug签名: $ jarsigner -verify -certs -verbose bin/TemplateGem.apk sm 2525 Sun ...

随机推荐

  1. POJ 1723

    #include <iostream> #include <algorithm> #define MAXN 10005 using namespace std; struct ...

  2. POJ2996Help Me with the Game

    http://poj.org/problem?id=2996 又是一个大模拟题,表示做模拟题做的恶心,这个题主要是对数据的处理,从表格中将数据取出来再进行处理即可. 主要注意的点就是:1.KQRBN五 ...

  3. lintcode :implement queue by two stacks 用栈实现队列

    题目 用栈实现队列 正如标题所述,你需要使用两个栈来实现队列的一些操作. 队列应支持push(element),pop() 和 top(),其中pop是弹出队列中的第一个(最前面的)元素. pop和t ...

  4. iOS开发--网络下载

    这里使用的是NSURLConnection的代理请求下载,并且是具有进度,UI能实时刷新,至于NSURLConnection如何请求.并且有几种请求方法请看NSURLConnection请求简介,在这 ...

  5. Hibernate逍遥游记-第8章 映射组成关系(<component>、<parent>)

    一. 1. <?xml version="1.0"?> <!DOCTYPE hibernate-mapping PUBLIC "-//Hibernate ...

  6. 输出进程相关联的环境变量信息(使用GetEnvironmentStrings取得信息,然后使用StringCchCopyN和StringCchPrintf保证字符串不会越界)

    void DumpEnvironmentStrings() { #define MAX_ENVIRONMENT_NAME_LENGTH     (128) #define MAX_ENVIRONMEN ...

  7. context:component-scan扫描使用上的容易忽略的use-default-filters

    问题 如下方式可以成功扫描到@Controller注解的Bean,不会扫描@Service/@Repository的Bean.正确 <context:component-scan base-pa ...

  8. centos下安装JDK8的方法

    判断是否安装 首先,我们得判断机子上是不是安装了jdk,好多人推荐使用java -version命令.我的计算机上使用java -version命令,内容如下: java version " ...

  9. JDBC学习总结(一)

    1.JDBC概述     JDBC是一种可以执行SQL语句并可返回结果的Java API,其全称是Java DataBase Connectivity,也是一套面向对象的应用程序接口API,它由一组用 ...

  10. MATLAB曲线绘制

    一. 二维数据曲线图1.1 绘制 单根二维曲线plot 函数的基本调用 格式为:plot(x,y) 其中x和y为长度相同的向量,分别用于存储x坐标 和y坐标数据. 例1-1 在0≤x≤2p区间内,绘制 ...