[新手上路]批处理新手入门导读[视频教程]批处理基础视频教程[视频教程]VBS基础视频教程[批处理精品]批处理版照片整理器
[批处理精品]纯批处理备份&还原驱动[批处理精品]CMD命令50条不能说的秘密[在线下载]第三方命令行工具[在线帮助]VBScript / JScript 在线参考
返回列表 发帖

进程内存读取工具-ReadProcessMemory

本帖最后由 老刘1号 于 2020-4-12 12:20 编辑
老刘制作——进程内存读取工具
用法:
        ReadProcessMemory       <ProcessID>     <BaseAddress>   <Long>
        ProcessID               指定需读取进程的PID
        BaseAddress             指定需读取进程内读取数据的起始地址
        Long                    指定需读取进程内读取数据的长度(Byte)

相关作品:http://www.bathome.net/thread-45155-1-1.html
  1. Option Explicit
  2. Imports System
  3. Module ReadProcessMemory
  4. Public Class ReadProcessMemory_Main
  5. Public Shared Sub Main(ByVal cmdArgs() As String)
  6. Const PROCESS_ALL_ACCESS As Long = &H1F0FFF
  7. If CmdArgs.Length = 3 Then
  8. If IsNumeric(cmdArgs(0)) And IsNumeric(cmdArgs(1)) And IsNumeric(cmdArgs(2)) Then
  9. Dim ProcessHandle,BytesLong,ReturnValue,Conter As Long
  10. Dim Bytes(Clng(cmdArgs(2))) As Byte
  11. ProcessHandle = WinAPI.OpenProcess(PROCESS_ALL_ACCESS,False,Clng(CmdArgs(0)))
  12. ReturnValue = WinAPI.ReadProcessMemory(ProcessHandle,Clng(CmdArgs(1)),Bytes,Clng(CmdArgs(2)),BytesLong)
  13. If ReturnValue = 1 Then
  14. For Conter = 0 To BytesLong - 1
  15. Console.Write(Right("0" & Hex(Bytes(Conter)),2)&Chr(&H20))
  16. Next
  17. Console.WriteLine()
  18. Else
  19. Console.WriteLine("读取失败!")
  20. End If
  21. Else
  22. Console.WriteLine("输入的值不合法!")
  23. End If
  24. Else
  25. Console.WriteLine("老刘制作——进程内存读取工具")
  26. Console.WriteLine("用法:")
  27. Console.WriteLine(" ReadProcessMemory <ProcessID> <BaseAddress> <Long>")
  28. Console.WriteLine(" ProcessID 指定需读取进程的PID")
  29. Console.WriteLine(" BaseAddress 指定需读取进程内读取数据的起始地址")
  30. Console.WriteLine(" Long 指定需读取进程内读取数据的长度(Byte)")
  31. End If
  32. End Sub
  33. End Class
  34. Public Class WinAPI
  35. Declare Function OpenProcess Lib "KERNEL32" ( _
  36. ByVal dwDesiredAccess As Long, _
  37. ByVal bInheritHandle As Long, _
  38. ByVal dwProcessId As Long ) _
  39. As Long
  40. Declare Function ReadProcessMemory Lib "KERNEL32" ( _
  41. ByVal hProcess As Long, _
  42. ByVal lpBaseAddress As Long, _
  43. lpBuffer As Byte(), _
  44. ByVal nSize As Long, _
  45. ByRef lpNumberOfBytesRead As Long) _
  46. As Long
  47. End Class
  48. End Module
复制代码
3

评分人数

开源顶一个

TOP

牛逼啊===========
为退烧而生

TOP

返回列表