C#读写内存操作方式

public class MemoryHelp
    {
        [DllImportAttribute("kernel32.dll", EntryPoint = "ReadProcessMemory")]
        public static extern bool ReadProcessMemory
        (
            IntPtr lpProcess,
            IntPtr lpBaseAddress,
            IntPtr lpBuffer,
            int nSize,
            IntPtr BytesRead
        );
        //打开进程  
        //kernel32.dll系统动态链接库  
        [DllImportAttribute("kernel32.dll", EntryPoint = "OpenProcess")]
        public static extern IntPtr OpenProcess
        (
            int iAccess,
            bool Handle,
            int ProcessID
        );
        //关闭句柄  
        [DllImport("kernel32.dll", EntryPoint = "CloseHandle")]
        private static extern void CloseHandle
        (
            IntPtr hObject
        );
        //写内存  
        [DllImportAttribute("kernel32.dll", EntryPoint = "WriteProcessMemory")]
        public static extern bool WriteProcessMemory
        (
            IntPtr lpProcess,
            IntPtr lpBaseAddress,
            int[] lpBuffer,
            int nSize,
            IntPtr BytesWrite


        );
        //写内存  
        [DllImportAttribute("kernel32.dll", EntryPoint = "WriteProcessMemory")]
        public static extern bool WriteProcessMemory
        (
            IntPtr lpProcess,
            IntPtr lpBaseAddress,
            byte[] lpBuffer,
            int nSize,
            IntPtr BytesWrite


        );
        //GetModuleHandle是获取一个应用程序或动态链接库的模块句柄。  
        [DllImport("kernel32")]
        public static extern IntPtr GetModuleHandle(string lpModuleName);


        [DllImport("kernel32.dll", SetLastError = true)]
        public static extern bool VirtualProtectEx
        (
            //修改内存的句柄  
            IntPtr hProcess,
            //要修改的起始地址  
            IntPtr lpAddress,
            //页区域大小  
            int dwSize,
            //访问方式  
            int flNewProtect,
            //用于保护改变前的保护属性  
            ref IntPtr lpflOldProtect
        );




        //根据进程名获取PID  
        public static int GetPidByProcessName(string processName)
        {
            Process[] ArrayProcess = Process.GetProcessesByName(processName);
            foreach (Process pro in ArrayProcess)
            {
                return pro.Id;
            }
            return 0;
        }


        //读内存模块  
        public static IntPtr ReadModule(string ModuleName)
        {
            return GetModuleHandle(ModuleName);
        }


        //读取内存的值  
        public static int ReadMemoryValue(int baseAddress, string ProcessName)
        {
            try
            {
                byte[] buffer = new byte[4];
                IntPtr byteAddress = Marshal.UnsafeAddrOfPinnedArrayElement(buffer, 0);
                IntPtr hProcess = OpenProcess(0x1F0FFF, false, GetPidByProcessName(ProcessName));
                ReadProcessMemory(hProcess, (IntPtr)baseAddress, byteAddress, 4, IntPtr.Zero);
                CloseHandle(hProcess);
                return Marshal.ReadInt32(byteAddress);
            }
            catch
            {
                return 0;
            }
        }
        public static long ReadMemoryValue(long baseAddress, string ProcessName)
        {
            try
            {
                string temp = ((IntPtr)baseAddress).ToString("x");
                byte[] buffer = new byte[4];
                IntPtr byteAddress = Marshal.UnsafeAddrOfPinnedArrayElement(buffer, 0);
                IntPtr hProcess = OpenProcess(0x1F0FFF, false, GetPidByProcessName(ProcessName));
                ReadProcessMemory(hProcess, (IntPtr)baseAddress, byteAddress, 4, IntPtr.Zero);
                CloseHandle(hProcess);
                string ss = ((IntPtr)baseAddress).ToString("x");
                return Marshal.ReadInt32(byteAddress);
            }
            catch
            {
                return 0;
            }
        }
        #region 写内存方式  


        //写内存整数型  
        public static void WriteMemoryValue(long baseAddress, string ProcessName, int value)
        {
            //打开进程获得句柄
            IntPtr hProcess = OpenProcess(0x1F0FFF, false, GetPidByProcessName(ProcessName));
            bool flag;
            int[] Data = new int[] { value };
            flag = WriteProcessMemory(hProcess, (IntPtr)baseAddress, Data, 4, IntPtr.Zero);
            CloseHandle(hProcess);
        }
        //写内存字节型  
        public static void WriteMemoryValue(int baseAddress, string ProcessName, byte[] value)
        {
            //打开进程获得句柄
            IntPtr hProcess = OpenProcess(0x1F0FFF, false, GetPidByProcessName(ProcessName));

            bool flag;
            //bool flag2;
            IntPtr adds = (IntPtr)0x33;
            //flag2 = VirtualProtectEx(hProcess, (IntPtr)baseAddress, 4, 0x40, ref adds);
            flag = WriteProcessMemory(hProcess, (IntPtr)baseAddress, value, value.Length, IntPtr.Zero);

            string temp = ((IntPtr)baseAddress).ToString("x");
            CloseHandle(hProcess);
        }


        #endregion


    }


你可能感兴趣的:(C#读写内存操作方式)