VC++信息安全编程（8）实现扫描内存，实现内存读写

扫描内存，实现内存读写是杀毒软件必备的功能，这个功能如何实现呢，

请见代码实现与分析

调用美国大牛写的PSAPI.DLL

 

#include "stdafx.h"
#include "DoProcess.h"
#include "DoProcessDlg.h"

#ifdef _DEBUG
#define new DEBUG_NEW
#undef THIS_FILE
static char THIS_FILE[] = __FILE__;
#endif
char ch[]="zhao1234";
/
// CDoProcessDlg dialog

CDoProcessDlg::CDoProcessDlg(CWnd* pParent /*=NULL*/)
	: CDialog(CDoProcessDlg::IDD, pParent)
{
	//{
  {AFX_DATA_INIT(CDoProcessDlg)
	m_Code = _T("zhao1234");
	m_Ebase = _T("");
	m_Esize = _T("");
	m_Eaddress = _T("");
	m_Edata = _T("");
	m_EAdd_Change = _T("");
	//}}AFX_DATA_INIT
	// Note that LoadIcon does not require a subsequent DestroyIcon in Win32
	m_hIcon = AfxGetApp()->LoadIcon(IDR_MAINFRAME);
}

void CDoProcessDlg::DoDataExchange(CDataExchange* pDX)
{
	CDialog::DoDataExchange(pDX);
	//{
  {AFX_DATA_MAP(CDoProcessDlg)
	DDX_Control(pDX, IDC_LIST2, m_list);
	DDX_Control(pDX, IDC_ScanProcess, m_Scan);
	DDX_Text(pDX, IDC_Code, m_Code);
    DDX_Control(pDX, IDC_LIST1, m_lCtrl);
	DDX_Text(pDX, IDC_Ebase, m_Ebase);
	DDX_Text(pDX, IDC_Esize, m_Esize);
	DDV_MaxChars(pDX, m_Esize, 2000);
	DDX_Text(pDX, IDC_Eaddress, m_Eaddress);
	DDX_Text(pDX, IDC_Edata, m_Edata);
	DDX_Text(pDX, IDC_EAdd_Change, m_EAdd_Change);
	//}}AFX_DATA_MAP
}

BEGIN_MESSAGE_MAP(CDoProcessDlg, CDialog)
	//{
  {AFX_MSG_MAP(CDoProcessDlg)
	ON_WM_PAINT()
	ON_WM_QUERYDRAGICON()
	ON_BN_CLICKED(IDC_GetProcess, OnGetProcess)
	ON_BN_CLICKED(IDC_GetProcess2, OnGetProcess2)
	ON_BN_CLICKED(IDC_KillProcess, OnKillProcess)
	ON_BN_CLICKED(IDC_ScanProcess, OnScanProcess)
	ON_BN_CLICKED(IDC_ReadMem, OnReadMem)
	ON_EN_CHANGE(IDC_Code, OnChangeCode)
	ON_EN_CHANGE(IDC_Ebase, OnChangeEbase)
	ON_EN_CHANGE(IDC_Esize, OnChangeEsize)
	ON_NOTIFY(NM_DBLCLK, IDC_LIST1, OnDblclkList1)
	ON_EN_CHANGE(IDC_Eaddress, OnChangeEaddress)
	ON_EN_CHANGE(IDC_Edata, OnChangeEdata)
	ON_BN_CLICKED(IDC_BWriteMem, OnBWriteMem)
	ON_BN_CLICKED(IDC_BEnumAllDLL, OnBEnumAllDLL)
	ON_BN_CLICKED(IDC_BChangeAttr, OnBChangeAttr)
	ON_EN_CHANGE(IDC_EAdd_Change, OnChangeEAddChange)
	ON_BN_CLICKED(IDC_BgetModule, OnBgetModule)
	ON_BN_CLICKED(IDC_BGetAllDLL2, OnBGetAllDLL)
	//}}AFX_MSG_MAP
END_MESSAGE_MAP()

/
// CDoProcessDlg message handlers

BOOL CDoProcessDlg::OnInitDialog()
{
	CDialog::OnInitDialog();

	// Set the icon for this dialog.  The framework does this automatically
	//  when the application's main window is not a dialog
	SetIcon(m_hIcon, TRUE);			// Set big icon
	SetIcon(m_hIcon, FALSE);		// Set small icon
	// TODO: Add extra initialization here

    ListView_SetExtendedListViewStyleEx(m_lCtrl.m_hWnd, LVS_EX_FULLROWSELECT|
		LVS_SORTDESCENDING, 0xFFFFFFFF); 	
    m_lCtrl.InsertColumn(0,"序号",HDF_LEFT,50,0);
    m_lCtrl.InsertColumn(1,"进程ID",HDF_LEFT,60,0);	
    m_lCtrl.InsertColumn(2,"路径",HDF_LEFT,560,0);	
    m_lCtrl.InsertColumn(3,"基地址",HDF_LEFT,60,0);
	
	return TRUE;  // return TRUE  unless you set the focus to a control
}

// If you add a minimize button to your dialog, you will need the code below
//  to draw the icon.  For MFC applications using the document/view model,
//  this is automatically done for you by the framework.

void CDoProcessDlg::OnPaint() 
{
	if (IsIconic())
	{
		CPaintDC dc(this); // device context for painting

		SendMessage(WM_ICONERASEBKGND, (WPARAM) dc.GetSafeHdc(), 0);

		// Center icon in client rectangle
		int cxIcon = GetSystemMetrics(SM_CXICON);
		int cyIcon = GetSystemMetrics(SM_CYICON);
		CRect rect;
		GetClientRect(&rect);
		int x = (rect.Width() - cxIcon + 1) / 2;
		int y = (rect.Height() - cyIcon + 1) / 2;

		// Draw the icon
		dc.DrawIcon(x, y, m_hIcon);
	}
	else
	{
		CDialog::OnPaint();
	}
}

// The system calls this to obtain the cursor to display while the user drags
//  the minimized window.
HCURSOR CDoProcessDlg::OnQueryDragIcon()
{
	return (HCURSOR) m_hIcon;
}

void CDoProcessDlg::OnGetProcess() 
{
m_list.ResetContent();
m_lCtrl.DeleteAllItems();
DWORD aProcesses[1024], cbNeeded, cProcesses;
unsigned int i;
//枚举系统进程ID列表
if(!EnumProcesses( aProcesses, sizeof(aProcesses), &cbNeeded ) )return;
// Calculate how many process identifiers were returned.
//计算进程数量
cProcesses = cbNeeded / sizeof(DWORD);
// 输出每个进程的名称和ID
for ( i = 0; i < cProcesses; i++ )PrintProcessNameAndID( aProcesses[i],i);

}


void CDoProcessDlg::PrintProcessNameAndID( DWORD processID ,int n)
{
char szProcessName[MAX_PATH] = "unknown";

//取得进程的句柄
HANDLE hProcess=OpenProcess( PROCESS_QUERY_INFORMATION|PROCESS_VM_READ,FALSE,processID);
//取得进程名称
if ( hProcess )
{
HMODULE hMod;
DWORD cbNeeded;
if(EnumProcessModules( hProcess, &hMod, sizeof(hMod), &cbNeeded) )
  //GetModuleBaseName( hProcess, hMod, szProcessName, sizeof(szProcessName) );
//该函数得到进程文件名
  GetModuleFileNameEx(hProcess,hMod,szProcessName, sizeof(szProcessName));
//该函数得到进程全文件名路径
 //回显进程名称和ID
CString inf0,inf1,inf2,inf3;

CFile fp;
if(fp.Open(szProcessName,CFile::modeRead)){
	IMAGE_DOS_HEADER      dos_header;
	IMAGE_NT_HEADERS      nt_header;
	fp.Read(&dos_header,sizeof(dos_header));
	fp.Seek(dos_header.e_lfanew,CFile::begin);
    fp.Read(&nt_header,sizeof(nt_header));
	fp.Close();
    inf3.Format("%X",nt_header.OptionalHeader.ImageBase);

}
else inf3="unknown";

inf0.Format("%d",n);
inf1.Format("%s",szProcessName);
inf2.Format("%d",processID);
m_lCtrl.InsertItem(0,"");//插入行
m_lCtrl.SetItemText(0,0,inf0);
m_lCtrl.SetItemText(0,1,inf2);//设置该行的不同列的显示字符
m_lCtrl.SetItemText(0,2,inf1);
m_lCtrl.SetItemText(0,3,inf3);
CloseHandle( hProcess );
}
}

void CDoProcessDlg::OnGetProcess2() 
{
//m_List.ResetContent();
//m_ListID.ResetContent();

CString inf;
HANDLE hProcessSnap = NULL;
PROCESSENTRY32 pe32= {0};
hProcessSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
if (hProcessSnap == (HANDLE)-1)
{
AfxMessageBox("不能建立快照");
  return ;
}
pe32.dwSize = sizeof(PROCESSENTRY32);
if (Process32First(hProcessSnap, &pe32))
{
   do{
   inf.Format("%s",pe32.szExeFile)