进程内存读取工具-ReadProcessMemory

老刘1号 · 发表于 2017-8-24 20:15:28

本帖最后由老刘1号于 2020-4-12 12:20 编辑

老刘制作——进程内存读取工具
用法：
      ReadProcessMemory    <ProcessID>    <BaseAddress> <Long>
      ProcessID             指定需读取进程的PID
      BaseAddress          指定需读取进程内读取数据的起始地址
      Long                   指定需读取进程内读取数据的长度（Byte）

相关作品：http://www.bathome.net/thread-45155-1-1.html

Option Explicit
Imports System
Module ReadProcessMemory
Public Class ReadProcessMemory_Main
Public Shared Sub Main(ByVal cmdArgs() As String)
Const PROCESS_ALL_ACCESS As Long = &H1F0FFF
If CmdArgs.Length = 3 Then
If IsNumeric(cmdArgs(0)) And IsNumeric(cmdArgs(1)) And IsNumeric(cmdArgs(2)) Then
Dim ProcessHandle,BytesLong,ReturnValue,Conter As Long
Dim Bytes(Clng(cmdArgs(2))) As Byte
ProcessHandle = WinAPI.OpenProcess(PROCESS_ALL_ACCESS,False,Clng(CmdArgs(0)))
ReturnValue = WinAPI.ReadProcessMemory(ProcessHandle,Clng(CmdArgs(1)),Bytes,Clng(CmdArgs(2)),BytesLong)
If ReturnValue = 1 Then
For Conter = 0 To BytesLong - 1
Console.Write(Right("0" & Hex(Bytes(Conter)),2)&Chr(&H20))
Next
Console.WriteLine()
Else
Console.WriteLine("读取失败！")
End If
Else
Console.WriteLine("输入的值不合法！")
End If
Else
Console.WriteLine("老刘制作——进程内存读取工具")
Console.WriteLine("用法：")
Console.WriteLine(" ReadProcessMemory <ProcessID> <BaseAddress> <Long>")
Console.WriteLine(" ProcessID 指定需读取进程的PID")
Console.WriteLine(" BaseAddress 指定需读取进程内读取数据的起始地址")
Console.WriteLine(" Long 指定需读取进程内读取数据的长度（Byte）")
End If
End Sub
End Class
Public Class WinAPI
Declare Function OpenProcess Lib "KERNEL32" ( _
ByVal dwDesiredAccess As Long, _
ByVal bInheritHandle As Long, _
ByVal dwProcessId As Long ) _
As Long
Declare Function ReadProcessMemory Lib "KERNEL32" ( _
ByVal hProcess As Long, _
ByVal lpBaseAddress As Long, _
lpBuffer As Byte(), _
ByVal nSize As Long, _
ByRef lpNumberOfBytesRead As Long) _
As Long
End Class
End Module

复制代码

happy886rr · 发表于 2017-8-25 10:19:29

开源顶一个

失控的疯子 · 发表于 2019-1-25 15:48:49

牛逼啊===========

		自动登录	找回密码
密码			注册

[新手上路]批处理新手入门导读	[视频教程]批处理基础视频教程	[视频教程]VBS基础视频教程	[批处理精品]批处理版照片整理器
[批处理精品]纯批处理备份&还原驱动	[批处理精品]CMD命令50条不能说的秘密	[在线下载]第三方命令行工具	[在线帮助]VBScript / JScript 在线参考

进程内存读取工具-ReadProcessMemory

评分

浏览过的版块