Reading or Writing to Another Processes Memory in C# z
http://www.jarloo.com/reading-and-writing-to-memory/
Declarations
[Flags]
public enum ProcessAccessFlags : uint
{
All = 0x001F0FFF,
Terminate = 0x00000001,
CreateThread = 0x00000002,
VMOperation = 0x00000008,
VMRead = 0x00000010,
VMWrite = 0x00000020,
DupHandle = 0x00000040,
SetInformation = 0x00000200,
QueryInformation = 0x00000400,
Synchronize = 0x00100000
} [DllImport("kernel32.dll")]
private static extern IntPtr OpenProcess(ProcessAccessFlags dwDesiredAccess, [MarshalAs(UnmanagedType.Bool)] bool bInheritHandle, int dwProcessId); [DllImport("kernel32.dll", SetLastError = true)]
private static extern bool WriteProcessMemory(IntPtr hProcess, IntPtr lpBaseAddress, byte[] lpBuffer, uint nSize, out int lpNumberOfBytesWritten); [DllImport("kernel32.dll", SetLastError = true)]
static extern bool ReadProcessMemory(IntPtr hProcess, IntPtr lpBaseAddress, [Out] byte[] lpBuffer, int dwSize, out int lpNumberOfBytesRead); [DllImport("kernel32.dll")]
public static extern Int32 CloseHandle(IntPtr hProcess);
Reading from another processes Memory
public static byte[] ReadMemory(Process process, int address, int numOfBytes, out int bytesRead)
{
IntPtr hProc = OpenProcess(ProcessAccessFlags.All, false, process.Id); byte[] buffer = new byte[numOfBytes]; ReadProcessMemory(hProc, new IntPtr(address), buffer, numOfBytes, out bytesRead);
return buffer;
}
Here is an example of a call to this function:
Process process = Process.GetProcessesByName("My Apps Name").FirstOrDefault();
int address = 0x02ED2910; int bytesRead;
byte[] value = ReadMemory(process, address, , out bytesRead);
Writing to another processes memory
public static bool WriteMemory(Process process, int address, long value, out int bytesWritten)
{
IntPtr hProc = OpenProcess(ProcessAccessFlags.All, false, process.Id); byte[] val = BitConverter.GetBytes(value); bool worked = WriteProcessMemory(hProc, new IntPtr(address), val, (UInt32) val.LongLength, out bytesWritten); CloseHandle(hProc); return worked;
}
Here is an example of a call to this function:
Process process = Process.GetProcessesByName(
"My Apps Name"
).FirstOrDefault();
int
address = 0x02ED2910;
int
bytesWritten;
bool
worked = WriteMemory(process, address, value,
out
bytesWritten);
函数功能:该函数从指定的进程中读入内存信息,被读取的区域必须具有访问权限。
函数原型:BOOL ReadProcessMemory(HANDLE hProcess,LPCVOID lpBaseAddress,LPVOID lpBuffer,DWORD nSize,LPDWORD lpNumberOfBytesRead);
参数:
hProcess:进程句柄
lpBaseAddress:读出数据的地址
lpBuffer:存放读取数据的地址
nSize:读出的数据大小
lpNumberOfBytesRead:数据的实际大小
C#中使用该函数首先导入命名空间:
- using System.Runtime.InteropServices;
using System.Runtime.InteropServices;
然后写API引用部分的代码,放入 class 内部
- [DllImport("kernel32.dll ")]
- static extern bool ReadProcessMemory(int hProcess, int lpBaseAddress,out int lpBuffer, int nSize, out int lpNumberOfBytesRead);
[DllImport("kernel32.dll ")]
static extern bool ReadProcessMemory(int hProcess, int lpBaseAddress,out int lpBuffer, int nSize, out int lpNumberOfBytesRead);
这个函数有五个参数,第一个参数是 进程句柄,由OpenProcess函数获取;第二个参数是要读出数据的地址,使用CE等辅助工具可取得;第三个参数是用于存放读取数据的地址;第四个参数是 要读出的数据大小;第五个参数是读出数据的实际大小。例如:
- IntPtr hwnd = FindWindow(null, "计算器");
- const int PROCESS_ALL_ACCESS = 0x1F0FFF;
- const int PROCESS_VM_READ = 0x0010;
- const int PROCESS_VM_WRITE = 0x0020;
- if (hwnd != IntPtr.Zero)
- {
- int calcID;
- int calcProcess;
- int dataAddress;
- int readByte;
- GetWindowThreadProcessId(hwnd, out calcID);
- calcProcess = OpenProcess(PROCESS_VM_READ | PROCESS_VM_WRITE, false, calcID);
- //假设地址0X0047C9D4存在信息
- ReadProcessMemory(calcProcess, 0X0047C9D4, out dataAddress, 4, out readByte);
- MessageBox.Show(dataAddress.ToString());
- }
- else
- {
- MessageBox.Show("没有找到窗口");
- }
IntPtr hwnd = FindWindow(null, "计算器");
const int PROCESS_ALL_ACCESS = 0x1F0FFF;
const int PROCESS_VM_READ = 0x0010;
const int PROCESS_VM_WRITE = 0x0020;
if (hwnd != IntPtr.Zero)
{
int calcID;
int calcProcess;
int dataAddress;
int readByte;
GetWindowThreadProcessId(hwnd, out calcID);
calcProcess = OpenProcess(PROCESS_VM_READ | PROCESS_VM_WRITE, false, calcID);
//假设地址0X0047C9D4存在信息
ReadProcessMemory(calcProcess, 0X0047C9D4, out dataAddress, 4, out readByte);
MessageBox.Show(dataAddress.ToString());
}
else
{
MessageBox.Show("没有找到窗口");
}
如果我们读取的一段内存中的数据,我们引入部分可修改成如下:
- //二维数组
- [DllImport("kernel32.dll ")]
- static extern bool ReadProcessMemory(int hProcess, int lpBaseAddress, byte[,] lpBuffer, int nSize, out int lpNumberOfBytesRead);
- //一维数组
- [DllImport("kernel32.dll ")]
- static extern bool ReadProcessMemory(int hProcess, int lpBaseAddress, byte[] lpBuffer, int nSize, out int lpNumberOfBytesRead);
//二维数组
[DllImport("kernel32.dll ")]
static extern bool ReadProcessMemory(int hProcess, int lpBaseAddress, byte[,] lpBuffer, int nSize, out int lpNumberOfBytesRead);
//一维数组
[DllImport("kernel32.dll ")]
static extern bool ReadProcessMemory(int hProcess, int lpBaseAddress, byte[] lpBuffer, int nSize, out int lpNumberOfBytesRead);
由于数组是引用传递,我们不需要写out关键字。
Reading or Writing to Another Processes Memory in C# z的更多相关文章
- Reading and Writing CSV Files in C#
Introduction A common requirement is to have applications share data with other programs. Although t ...
- Reading and writing RData files
前面添加个lapply()或者dplyr::llply()就能读取,储存多个文件了.http://bluemountaincapital.github.io/FSharpRProvider/readi ...
- Reading and writing
A text file is a sequence of characters stored on a permanent medium like a hard drive, flash memory ...
- Analysis about different methods for reading and writing file in Java language
referee:Java Programming Tutorial Advanced Input & Output (I/O) JDK 1.4+ introduced the so-calle ...
- Apache POI – Reading and Writing Excel file in Java
来源于:https://www.mkyong.com/java/apache-poi-reading-and-writing-excel-file-in-java/ In this article, ...
- PostgreSQL Reading Ad Writing Files、Execution System Instructions Vul
catalog . postgresql简介 . 文件读取/写入 . 命令执行 . 影响范围 . 恶意代码分析 . 缓解方案 1. postgresql简介 PostgreSQL 是一个自由的对象-关 ...
- 【转】Native Thread for Win32 C- Creating Processes(通俗易懂,非常好)
http://www.bogotobogo.com/cplusplus/multithreading_win32C.php To create a new process, we need to ca ...
- five kinds of IPC methods
Shared memory permits processes to communicate by simply reading and writing to a specified memory l ...
- Android Security
Android Security¶ 确认签名¶ Debug签名: $ jarsigner -verify -certs -verbose bin/TemplateGem.apk sm 2525 Sun ...
随机推荐
- POJ 1723
#include <iostream> #include <algorithm> #define MAXN 10005 using namespace std; struct ...
- POJ2996Help Me with the Game
http://poj.org/problem?id=2996 又是一个大模拟题,表示做模拟题做的恶心,这个题主要是对数据的处理,从表格中将数据取出来再进行处理即可. 主要注意的点就是:1.KQRBN五 ...
- lintcode :implement queue by two stacks 用栈实现队列
题目 用栈实现队列 正如标题所述,你需要使用两个栈来实现队列的一些操作. 队列应支持push(element),pop() 和 top(),其中pop是弹出队列中的第一个(最前面的)元素. pop和t ...
- iOS开发--网络下载
这里使用的是NSURLConnection的代理请求下载,并且是具有进度,UI能实时刷新,至于NSURLConnection如何请求.并且有几种请求方法请看NSURLConnection请求简介,在这 ...
- Hibernate逍遥游记-第8章 映射组成关系(<component>、<parent>)
一. 1. <?xml version="1.0"?> <!DOCTYPE hibernate-mapping PUBLIC "-//Hibernate ...
- 输出进程相关联的环境变量信息(使用GetEnvironmentStrings取得信息,然后使用StringCchCopyN和StringCchPrintf保证字符串不会越界)
void DumpEnvironmentStrings() { #define MAX_ENVIRONMENT_NAME_LENGTH (128) #define MAX_ENVIRONMEN ...
- context:component-scan扫描使用上的容易忽略的use-default-filters
问题 如下方式可以成功扫描到@Controller注解的Bean,不会扫描@Service/@Repository的Bean.正确 <context:component-scan base-pa ...
- centos下安装JDK8的方法
判断是否安装 首先,我们得判断机子上是不是安装了jdk,好多人推荐使用java -version命令.我的计算机上使用java -version命令,内容如下: java version " ...
- JDBC学习总结(一)
1.JDBC概述 JDBC是一种可以执行SQL语句并可返回结果的Java API,其全称是Java DataBase Connectivity,也是一套面向对象的应用程序接口API,它由一组用 ...
- MATLAB曲线绘制
一. 二维数据曲线图1.1 绘制 单根二维曲线plot 函数的基本调用 格式为:plot(x,y) 其中x和y为长度相同的向量,分别用于存储x坐标 和y坐标数据. 例1-1 在0≤x≤2p区间内,绘制 ...