Option Explicit
Module WriteProcessMemory
	Public Class WriteProcessMemory_Main
		Public Shared Sub Main(ByVal cmdArgs() As String)
			Const PROCESS_ALL_ACCESS As Long = &H1F0FFF
			Const PAGE_EXECUTE_READWRITE As Long = &H40
			If CmdArgs.Length > 2 Then
				If IsNumeric(cmdArgs(0)) And IsNumeric(cmdArgs(1)) Then
					Dim ProcessHandle,OldProtect,ReturnValue(2),Conter(1) As Long
					Dim Bytes() As Byte
					Conter(1) = 0
					Rem 获取HEXs并生成数组
					For Conter(0) = 2 to CmdArgs.Length - 1
						If IsNumeric(CmdArgs(Conter(0))) Then
							If CLng(CmdArgs(Conter(0))) >= 0 And _
								CLng(CmdArgs(Conter(0))) <= &HFF Then
									ReDim Preserve Bytes(Conter(1))
									Bytes(Conter(1)) = CByte(CmdArgs(Conter(0)))
									Conter(1) = Conter(1) + 1
							End If
						End If
					Next
					Rem 以最高权限附加到目标进程
					ProcessHandle = Win32.OpenProcess( _
						PROCESS_ALL_ACCESS, _
						False, _
						Clng(CmdArgs(0)))
					Rem 更改内存属性为读+写+执行
					ReturnValue(0) = Win32.VirtualProtectEx( _
						ProcessHandle, _
						Clng(CmdArgs(1)), _
						Conter(1), _
						PAGE_EXECUTE_READWRITE, _
						OldProtect)
					Rem 写入数据
					ReturnValue(1) = Win32.WriteProcessMemory( _
						ProcessHandle, _
						Clng(CmdArgs(1)), _
						Bytes,Conter(1),0)
					If ReturnValue(1) <> 1 Then
						Console.WriteLine("写入失败！")
					End If
					If ReturnValue(0) <> 0 Then
						Rem 还原内存属性
						ReturnValue(2) = Win32.VirtualProtectEx( _
							ProcessHandle, _
							Clng(CmdArgs(1)), _
							Conter(1), _
							OldProtect,0)
					End If
				Else
					Console.WriteLine("输入的值不合法！")
				End If
			Else
				Console.WriteLine("老刘制作——进程内存写入工具")
				Console.WriteLine()
				Console.WriteLine("用法：")
				Console.WriteLine("	WriteProcessMemory	<ProcessID>	<BaseAddress>	<HEX>	...")
				Console.WriteLine("	ProcessID		指定需写入进程的PID")
				Console.WriteLine("	BaseAddress		指定需写入进程内数据的起始地址")
				Console.WriteLine("	HEXs			需写入的数据（至少一个，数值范围：0~255）")
				Console.WriteLine()
				Console.WriteLine("提示：")
				Console.WriteLine("传入数据时，十六进制请用""&H""前缀表示")
			End If
		End Sub
	End Class	
	Public Class Win32
		Declare Function OpenProcess Lib "KERNEL32" ( _
			ByVal dwDesiredAccess As Long, _
			ByVal bInheritHandle As Long, _
			ByVal dwProcessId As Long ) _
			As Long
		Declare Function WriteProcessMemory Lib "KERNEL32" ( _
			ByVal hProcess As Long, _
			ByVal lpBaseAddress As Long, _
			ByVal lpBuffer As Byte(), _
			ByVal nSize As Long, _
			ByRef lpNumberOfBytesWritten As Long) _
			As Long
		Declare Function VirtualProtectEx Lib "KERNEL32" ( _
			ByVal hProcess As Long, _
			ByVal lpAddress As Long, _
			ByVal dwSize As Long, _
			ByVal flNewProtect As Long, _
			ByRef lpflOldProtect As Long) _
			As Long
	End Class
 End Module
复制代码