读取任意进程内存

用进程快照信息找到进程,打开后读取内存,没什么技术含量。。

读取任意进程内存_第1张图片


void CReadMemDlg::OnBtnRead() 
{
	UpdateData();
	void *nAddr;
	UINT nLen;
	sscanf(m_strAddr,"%x",&nAddr);
	sscanf(m_strLen,"%x",&nLen);

	HANDLE hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPALL,0);
	if(hSnapshot == NULL) {
		AfxMessageBox("无法创建进程快照!");
		return;
	}
	PROCESSENTRY32 entry;
	entry.dwSize = sizeof(entry);
	BOOL bOK = Process32First(hSnapshot,&entry);
	DWORD id = 0;
	while(bOK) {
		if(entry.szExeFile == m_strProc) {
			id = entry.th32ProcessID;
			break;
		}
		bOK = Process32Next(hSnapshot,&entry);
	}
	CloseHandle(hSnapshot);
	if(!bOK) {
		AfxMessageBox("无法找到进程!");
		return;
	}
	HANDLE hProc = OpenProcess(PROCESS_ALL_ACCESS,FALSE,id);
	if(hProc == 0) {
		AfxMessageBox("无法打开进程!");
		return;
	}
	BYTE *pBuf = new BYTE[nLen];
	if(!ReadProcessMemory(hProc,nAddr,pBuf,nLen,NULL)) {
		AfxMessageBox("无法读取内存!");
		CloseHandle(hProc);
		return;
	}
	CloseHandle(hProc);
	m_strRes.Empty();
	for(int i=0;i



你可能感兴趣的:(研究)