C 读取内存的实例

最新推荐文章于 2023-03-17 01:00:00 发布

这是晾衣服的地方吗

最新推荐文章于 2023-03-17 01:00:00 发布

阅读量2.7k

点赞数

本文链接：https://blog.csdn.net/ffghggf/article/details/83920103

版权

本文详细介绍了C#中操作内存读取的方法，包括PtrToByte、PtrToChar等函数，以及如何使用ReadProcessMemory函数读取远程进程内存。同时，还涉及到获取进程句柄和权限的相关函数，如OpenProcess。内容涵盖内存读取的基础实例和使用场景。

摘要由CSDN通过智能技术生成

分享一下我老师大神的人工智能教程！零基础，通俗易懂！http://blog.csdn.net/jiangjunshow

也欢迎大家转载本篇文章。分享知识，造福人民，实现我们中华民族伟大复兴！

C#操作内存读写方法是什么呢？让我们来看看具体的实例实现：

using System.Runtime.InteropServices;
using System.Text;
public class Function
{
//C#操作内存读写方法
public staticbyte PtrToByte( int Ptr )
{
byte b = Marshal.ReadByte( ( IntPtr ) Ptr );
return b;
}
public staticchar PtrToChar( int Ptr )
{
byte b = Marshal.ReadByte( ( IntPtr ) Ptr );
return ( char ) b;
}
public staticshort PtrToShort( int Ptr )
{
short b = Marshal.ReadInt16( ( IntPtr ) Ptr );
return b;
}
//C#操作内存读写方法
public staticushort PtrToUShort( int Ptr )
{
ushort b = ( ushort ) Marshal.ReadInt16( ( IntPtr ) Ptr );
return b;
}
public staticint PtrToInt( int Ptr )
{
int b = Marshal.ReadInt32( ( IntPtr ) Ptr );
return b;
}
public staticuint PtrToUInt( int Ptr )
{
uint b = ( uint ) Marshal.ReadInt32( ( IntPtr ) Ptr );
return b;
}
public staticlong PtrToLong( int Ptr )
{
long b = Marshal.ReadInt64( ( IntPtr ) Ptr );
return b;
} //C#操作内存读写方法
public staticulong PtrToULong( int Ptr )
{
ulong b = ( ulong ) Marshal.ReadInt64( ( IntPtr ) Ptr );
return b;
}
// Convert an ip address stored an address to equivalent string value
public staticstring GetPtrToIpAddr(int intPtr,int varlen)
{
int i = 0;
StringBuilder sb = new StringBuilder(0,varlen*4);
byte[] byx = newbyte[varlen];
// ip address cann't have zero value C#操作内存读写方法
// ip address cann't have zero length C#操作内存读写方法
if( ( intPtr == 0 ) || ( varlen == 0 ) ) return "";
Marshal.Copy( ( IntPtr ) intPtr , byx , 0 , varlen );
for( i = 0; i < varlen - 1; i ++ )
{
sb.Append(byx[i]);
sb.Append('.');
}
sb.Append(byx[varlen - 1]);
return sb.ToString();
}
}

BOOL ReadProcessMemory( HANDLE hProcess, PVOID pvAddressRemote, PVOID pvBufferLocal, DWORD dwSize, PDWORD pdwNumBytesRead);

参数
hProcess为远程进程的句柄
pvAddressRemote用于指明远程进程中的地址
pvBufferLocal是本地进程中的内存地址
dwSize是需要传送的字节数
pdwNumBytesRead和pdwNumBytesWritten用于指明实际传送的字节数.当函数返回时，可以查看这两个参数的值.

ReadProcessMemory读出数据，权限要大一些。下面这个打开进程的方式具备了查询读和写的权限

hProcess = OpenProcess(PROCESS_QUERY_INFORMATION Or PROCESS_VM_OPERATION Or PROCESS_VM_READ Or PROCESS_VM_WRITE, 0, ProcessId)

然后就要结合上面的程序来搜索了。只有当内存是处于被占用状态时才去读取其中的内容，而忽略空闲状态的内存。程序我就不在这儿写了，和上面那段差不多。只是把dwTotalCommit = dwTotalCommit + mi.RegionSize换成了读取内存以及搜索这一块内存的函数而已。

1.通过FindWindow读取窗体的句柄

2.通过GetWindowThreadProcessId读取查找窗体句柄进程的PID值

3.用OpenProcess(PROCESS_QUERY_INFORMATION Or PROCESS_VM_OPERATION Or PROCESS_VM_READ Or PROCESS_VM_WRITE, 0, ProcessId)打开查到PID值的进程. 此打开具备读取,写入,查询的权限

4.ReadProcessMemory读出指定的内存地址数据

1 //C#读取内存例子　
2
3 using System;
4 using System.Collections.Generic;
5 using System.Text;
6 using System.Runtime.InteropServices;
7 using System.Diagnostics;
8 using System.Management;
9
10 publicclass key
11     {
12         const uint PROCESS_ALL_ACCESS= 0x001F0FFF;
13         const uint KEYEVENTF_EXTENDEDKEY= 0x1;
14         const uint KEYEVENTF_KEYUP= 0x2;
15         private readonlyint MOUSEEVENTF_LEFTDOWN= 0x2;
16         private readonlyint MOUSEEVENTF_LEFTUP= 0x4;
17         const uint KBC_KEY_CMD= 0x64;
18         const uint KBC_KEY_DATA= 0x60;
19         //得到窗体句柄的函数,FindWindow函数用来返回符合指定的类名( ClassName )和窗口名( WindowTitle )的窗口句柄
20         [DllImport("user32.dll", CharSet = CharSet.Auto)]
21         public staticextern IntPtr FindWindow(
22         string lpClassName, // pointer to class name
23        string lpWindowName// pointer to window name
24         );
25         [DllImport("user32.dll")]
26         private staticextern int GetWindowThreadProcessId(IntPtr id,int pid);
27
28         [DllImport("kernel32.dll")]
29         private staticextern void CloseHandle
30         (
31         uint hObject //Handle to object
32         );
33         //读取进程内存的函数
34         [DllImport("kernel32.dll")]
35         static externbool ReadProcessMemory(uint hProcess, IntPtr lpBaseAddress,
36         IntPtr lpBuffer,uint nSize, ref uint lpNumberOfBytesRead);
37         //得到目标进程句柄的函数
38         [DllImport("kernel32.dll")]
39         public staticextern uint OpenProcess(uint dwDesiredAccess,bool bInheritHandle,int dwProcessId);
40         //鼠标事件声明
41         [DllImport("user32.dll")]
42         static externbool setcursorpos(int x,int y);
43         [DllImport("user32.dll")]
44         static externvoid mouse_event(mouseeventflag flags,int dx, int dy, uint data, UIntPtr extrainfo);
45         //键盘事件声明
46         [DllImport("user32.dll")]
47         static externbyte MapVirtualKey(byte wCode,int wMap);
48         [DllImport("user32.dll")]
49         static externshort GetKeyState(int nVirtKey);
50         [DllImport("user32.dll")]
51         static externvoid keybd_event(byte bVk,byte bScan, uint dwFlags, uint dwExtraInfo);
52         //键盘事件声明winio
53         [DllImport("winio.dll")]
54         public staticextern bool InitializeWinIo();
55         [DllImport("winio.dll")]
56         public staticextern bool GetPortVal(IntPtr wPortAddr,out int pdwPortVal,byte bSize);
57         [DllImport("winio.dll")]
58         public staticextern bool SetPortVa