进程内存查询器简单代码

#include<Windows.h>
#include<stdio.h>

typedef unsigned int uint;
void main()
{
	uint iPId;
	printf("Enter ProcessId:");
	scanf("%d", &iPId);

	HANDLE hProc = OpenProcess(PROCESS_VM_READ, FALSE, iPId);
	if(hProc == INVALID_HANDLE_VALUE)
	{
		printf("OpenProcess Error:%d\n", GetLastError());
		return;
	}

	char* pStrFind = "普通舰船的鱼雷发射";
	int   iFindLen = strlen(pStrFind);
	char* pMem = (char*)0;
	char  pBuff[1024];
	SIZE_T iRead = 0;
	int    iFindNum = 0;
	int    iLeftByte = 0;
	bool   bNext = true;

	while(bNext && (ReadProcessMemory(hProc, pMem, pBuff+iLeftByte, 1024-iLeftByte, &iRead) || GetLastError() == 299))	// Copy Part
	{
		if(pMem > (char*)(0xffffffff - 1024 + iLeftByte))
		{
			bNext = false;
		}
		else
		{
			pMem += (1024 - iLeftByte);
		}

		if(iRead != 0)
		{
			iLeftByte = iFindLen;

			for(int i = 0; i < 1025-iFindLen; i++)
			{
				bool bMatched = true;
				for(int j = 0; j < iFindLen; j++)
				{
					if(pStrFind[j] != pBuff[i+j])
					{
						bMatched = false;
						break;
					}
				}
				if(bMatched)
				{
					// 找到一个
					printf("%d\t%p\n", iFindNum++, pMem+i);
				}
			}
			memmove_s(pBuff, 1024, pBuff+1025-iFindLen, iFindLen-1);
		}
		else
		{
			iLeftByte = 0;
		}
	}
}