#include<windows.h>
#include<stdio.h>
#include<iostream.h>
BOOL CompareAPage(DWORD dwBaseAddr,DWORD dwValue);
BOOL FindFirst(DWORD dwValue);
BOOL CompareAPage(DWORD dwBaseAddr,DWORD dwValue);
void ShowList();
BOOL FindFirst(DWORD dwValue); //在目標(biāo)進(jìn)程空間進(jìn)行第1次查找
BOOL FindNext(DWORD dwValue); //在目標(biāo)進(jìn)程地址空間進(jìn)行第2，3，……次查找
DWORD g_arList[1024]; //地址列表
int g_nListCnt=0; //有效地址個(gè)數(shù)
HANDLE g_hProcess; //目標(biāo)進(jìn)程句柄
int main(int argc,char argv[])
{
char szFileName[]="..\\hao005\\debug\\hao005.exe";
STARTUPINFO si={sizeof(si)};
PROCESS_INFORMATION pi;
::CreateProcess(NULL,szFileName,NULL,
NULL,FALSE,CREATE_NEW_CONSOLE,NULL,NULL,&si,&pi);
::CloseHandle(pi.hThread);
g_hProcess=pi.hProcess;
int iVal;
printf("Input val=");
scanf("%d",&iVal);
BOOL a=FindFirst(iVal);
ShowList();
::CloseHandle(g_hProcess);
cout<<"a="<<a<<endl;
return 0;
}
BOOL CompareAPage(DWORD dwBaseAddr,DWORD dwValue)
{//讀一頁
BYTE arBytes[4096];
if(!::ReadProcessMemory(g_hProcess,(LPVOID)dwBaseAddr,arBytes,4096,NULL))
{return FALSE;
cout<<"22222222222"<<endl;}
//此頁不可讀
//在這一頁中讀
DWORD* pdw;
for(int i=0;i<(int)1024*4-3;i++);
{
pdw=(DWORD*)&arBytes[i];
if(pdw[0]==dwValue) //等于要找的值
{
if(g_nListCnt>=1024)
return FALSE;
cout<<"找到了"<<endl;
//添加到全局變量
g_arList[g_nListCnt++]=dwBaseAddr+i;
}
}
return TRUE;
}
BOOL FindFirst(DWORD dwValue)
{
const DWORD dwOneGB=1024*1024*1024;
const DWORD dwOnePage=4*1024;
if(g_hProcess==NULL)
return FALSE;
DWORD dwBase;
OSVERSIONINFO vi={sizeof(vi)};
::GetVersionEx(&vi);
if(vi.dwPlatformId==VER_PLATFORM_WIN32_WINDOWS)
{dwBase=4*1024*1024;
cout<<"0000000"<<endl;}
else
{ dwBase=640*1024;
cout<<"111111111111"<<endl;}
//開始地址到2GB的地址空間進(jìn)行查找
for(;dwBase<2*dwOneGB;dwBase+=dwOnePage)
CompareAPage(dwBase,dwValue);
printf("g_nListCnt=%d\n",g_nListCnt);
return TRUE;
}
void ShowList()
{
for(int i=0;i<g_nListCnt;i++)
printf("%8x\n",g_arList[i]);
}
我的就是查不到喲，if(pdw[0]==dwValue) //等于要找的值
{
if(g_nListCnt>=1024)
return FALSE;
cout<<"找到了"<<endl;
//添加到全局變量
g_arList[g_nListCnt++]=dwBaseAddr+i;
}這些好像根本沒運(yùn)行的，想不出了， 大哥學(xué)過幫看下。
回復(fù) 更多評論