对指定进程读内存和写内存

先声明一些变量

HANDLE objhandle;//目标句柄

int  baseaddress;//开始读取的基址

char bytes[14];//保存内存数据

char putbytes[14] = {"你好"};

本次操作不需要提权

打开进程

objhandle = OpenProcess(PROCESS_ALL_ACCESS, FALSE, 12012);

读取内存

baseaddress = 0x403072;

ReadProcessMemory(objhandle, (LPCVOID)baseaddress, (LPVOID)bytes, sizeof(bytes), NULL);

结果保存到 bytes 数组中

修改内存页面属性,不然不能写

DWORD protectmunber = 0;

VirtualProtectEx(objhandle, (LPVOID)baseaddress, sizeof(putbytes), PAGE_EXECUTE_READWRITE, (PDWORD)&protectmunber);

写内存

WriteProcessMemory(objhandle, (LPVOID)baseaddress, putbytes, sizeof(putbytes), NULL);

恢复内存页面属性

VirtualProtectEx(objhandle, (LPVOID)baseaddress, sizeof(putbytes), protectmunber, (PDWORD)&protectmunber);

效果如图:

对指定进程读内存和写内存_第1张图片

全部代码如下,myputerror函数是封装的getlasterror函数

#define _WIN32_WINNT 0x0501

#include

#include

HANDLE objhandle;//目标句柄

int  baseaddress;//开始读取的基址

char bytes[14];//保存内存数据

char putbytes[14] = {"你好"};

void myputerror(void);

int main(int argc, char* argv[]){

//获得进程的访问令牌,如果 OpenProcess 无法打开进程的话

//要修改访问权限的进程句柄,指定要进行的操作类型,返回访问令牌指针

//得到本进程的令牌

HANDLE hToken;

if (!OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &hToken)){

myputerror();

}else{

printf("获取令牌句柄成功\n");

}

//查看系统权限的特权值

TOKEN_PRIVILEGES tp;//新特权结构体

LUID Luid;

if (LookupPrivilegeValue(NULL, SE_DEBUG_NAME, &Luid) == 0){

printf("获取LUID失败 ");

myputerror();

}else{

printf("获取LUID成功 %d\n", Luid.LowPart);

}

//给TP和TP里的LUID结构体赋值

tp.PrivilegeCount = 1;

tp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;

tp.Privileges[0].Luid = Luid;

//启用指定访问令牌的特权

if (AdjustTokenPrivileges(hToken, FALSE, &tp, sizeof(TOKEN_PRIVILEGES), NULL, NULL) !=0){

if (GetLastError() == ERROR_SUCCESS){

printf("指定的特权修改成功!\n");//其实是打开原本用户就有的特权

}

else{

printf("修改特权不完全或失败!\n");

myputerror();

}

}else{

printf("修改失败!\n");

myputerror();

}

objhandle = OpenProcess(PROCESS_ALL_ACCESS, FALSE, 12012);

if (objhandle == 0){

myputerror();

}

baseaddress = 0x403072;

if (ReadProcessMemory(objhandle, (LPCVOID)baseaddress, (LPVOID)bytes, sizeof(bytes), NULL)!=0){

printf("结果:%s\n ", bytes);

}

else{

myputerror();

}

//设置页面属性

DWORD protectmunber = 0;

//修改内存页属性为可写

if (VirtualProtectEx(objhandle, (LPVOID)baseaddress, sizeof(putbytes), PAGE_EXECUTE_READWRITE, (PDWORD)&protectmunber) == FALSE){

myputerror();

}

if (WriteProcessMemory(objhandle, (LPVOID)baseaddress, putbytes, sizeof(putbytes), NULL)==0){

myputerror();

}

else{

printf("内存写入成功\n");

if (ReadProcessMemory(objhandle, (LPCVOID)baseaddress, (LPVOID)bytes, sizeof(bytes), NULL) != 0){

printf("结果:%s\n ", bytes);

myputerror();

}

else{

myputerror();

}

}

//恢复

if (VirtualProtectEx(objhandle, (LPVOID)baseaddress, sizeof(putbytes), protectmunber, (PDWORD)&protectmunber) == FALSE){

myputerror();

}

//TerminateProcess(objhandle, 0);

getchar();

return 0;

}

你可能感兴趣的:(对指定进程读内存和写内存)