内存断点原理:就是通过设置内存块页面的权限,使其成为保护页。这样当CPU访问该页面时,就会触发保护页的访问异常,产生中断。需要调用异常处理函数将权限恢复从而继续执行。
实现步骤:
1. 找函数的地址还是和前面一样
2. 通过VirtualQueryEx传入地址,获取一个填充好的MEMORY_BASIC_INFORMATION结构,里面包含页基址、页大小等信息。
3. VirtualProtectEx设置页面权限为PAGE_GUARD以上
这里注意一个断点函数地址可能跨2个页,所以需要判别基质+大小是否已经跨过了断点地址之后
实验结果:
Enter pid:12808
OpenProcess Successful, HANDLE 520
Get Module Handle 1989869568
Get Address: 0x76a27960
[*]Address of wprintf: 0x76a27960
Event Code: 3 Thread ID: 2812
Event Code: 6 Thread ID: 2812
Event Code: 2 Thread ID: 13828
Event Code: 2 Thread ID: 13328
Event Code: 2 Thread ID: 14236
Event Code: 6 Thread ID: 2812
Event Code: 6 Thread ID: 2812
Event Code: 6 Thread ID: 2812
Event Code: 6 Thread ID: 2812
Event Code: 6 Thread ID: 2812
Event Code: 6 Thread ID: 2812
Event Code: 6 Thread ID: 2812
Event Code: 6 Thread ID: 2812
Event Code: 6 Thread ID: 2812
Event Code: 6 Thread ID: 2812
Event Code: 6 Thread ID: 2812
Event Code: 6 Thread ID: 2812
Event Code: 6 Thread ID: 2812
Event Code: 6 Thread ID: 2812
Event Code: 6 Thread ID: 2812
Event Code: 6 Thread ID: 2812
Event Code: 6 Thread ID: 2812
Event Code: 6 Thread ID: 2812
Event Code: 6 Thread ID: 2812
Event Code: 6 Thread ID: 2812
Event Code: 6 Thread ID: 2812
Event Code: 6 Thread ID: 2812
Event Code: 6 Thread ID: 2812
Event Code: 6 Thread ID: 2812
Event Code: 6 Thread ID: 2812
Event Code: 6 Thread ID: 2812
Event Code: 6 Thread ID: 2812
Event Code: 6 Thread ID: 2812
Event Code: 6 Thread ID: 2812
Event Code: 6 Thread ID: 2812
Event Code: 2 Thread ID: 13348
Event Code: 1 Thread ID: 13348
[*] Exception address: 0x77318d20
[*] Hit the first breakpoint.
Event Code: 4 Thread ID: 13348
Event Code: 1 Thread ID: 2812
Guard Page Access Detected.