如何实现C++读写进程内存值

OpenProcess

方法名称：OpenProcess

位置：Kernel32.dll

OpenProcess 函数用来打开一个已存在的进程对象，并返回进程的句柄。

HANDLE OpenProcess(

DWORD dwDesiredAccess, //渴望得到的访问权限（标志）

BOOL bInheritHandle, // 是否继承句柄

DWORD dwProcessId// 进程标示符

);

检索顶级窗口的句柄，该窗口的类名和窗口名与指定的字符串匹配。此函数不搜索子窗口。此函数不执行区分大小写的搜索。
要从指定的子窗口开始搜索子窗口，请使用FindWindowEx函数。

HWND FindWindowA(
  [in, optional] LPCSTR lpClassName,
  [in, optional] LPCSTR lpWindowName
);

具体参数介绍 FindWindowA function (winuser.h) - Win32 apps | Microsoft Docs

1.读取进程内存值

BOOL ReadProcessMemory(

HANDLE hProcess, // 被读取进程的句柄；

LPCVOID lpBaseAddress, // 读的起始地址；

LPVOID lpBuffer, // 存放读取数据缓冲区；

DWORD nSize, // 一次读取的字节数；

LPDWORD lpNumberOfBytesRead // 实际读取的字节数；

);

ReadProcessMemory是一个内存操作函数， 其作用为根据进程句柄读入该进程的某个内存空间；函数原型为BOOL ReadProcessMemory(HANDLE hProcess, LPCVOID lpBaseAddress, LPVOID lpBuffer, DWORD nSize, LPDWORD lpNumberOfBytesRead); 由布尔声明可以看出， 当函数读取成功时返回1， 失败则返回0， 具体参数含义将在下文中指出。

案例:

#include <iostream>
#include <Windows.h>

using namespace std;

int main(){

	int readTest = 0; // We store the Value we read from the Process here

	HWND hwnd = FindWindowA(NULL, "Tutorial-x86_64"); // HWND (Windows window) by Window Name

	// Check if HWND found the Window
	if (hwnd == NULL) {
		cout << "Can't find Process." << endl;
		Sleep(2000); // Sleep 2 seconds
		exit(-1); // Exit the program if it did not find the Window
	} else {
		DWORD procID; // A 32-bit unsigned integer, DWORDS are mostly used to store Hexadecimal Addresses
		GetWindowThreadProcessId(hwnd, &procID); // Getting our Process ID, as an ex. like 000027AC
		HANDLE handle = OpenProcess(PROCESS_ALL_ACCESS, FALSE, procID); // Opening the Process with All Access

		if (procID == NULL) {
			cout << "Can't find Process." << endl;
			Sleep(2000); // Sleep 2 seconds
			exit(-1); // Exit the program if it did not find the Window
		} else {
			// Read the Process Memory, 03007640 is the Address, we read the Value from and save it in readTest
			ReadProcessMemory(handle, (PBYTE*)0x03007640, &readTest, sizeof(readTest), 0);
			cout << readTest << endl;
			Sleep(5000); // Sleep 5 seconds
		}
	}
}

2.写内存值

BOOL WriteProcessMemory(

HANDLE hProcess,  //进程的句柄

LPVOID lpBaseAddress, // 写入进程的位置

LPVOID lpBuffer, //数据当前存放地址

DWORD nSize, //数据的长度

LPDWORD lpNumberOfBytesWritten //实际数据的长度

);

WriteProcessMemory是计算机语言中的一种函数。此函数能写入某一进程的内存区域（直接写入会出Access Violation错误），故需此函数入口区必须可以访问，否则操作将失败。

案例:

#include <iostream>
#include <Windows.h>

using namespace std;

int main() {

	int newValue = 5000; // The new Value we set on the address

	HWND hwnd = FindWindowA(NULL, "Tutorial-x86_64"); // HWND (Windows window) by Window Name

	// Check if HWND found the Window
	if (hwnd == NULL) {
		cout << "Can't find Process." << endl;
		Sleep(2000); // Sleep 2 seconds
		exit(-1); // Exit the program if it did not find the Window
	}
	else {
		DWORD procID; // A 32-bit unsigned integer, DWORDS are mostly used to store Hexadecimal Addresses
		GetWindowThreadProcessId(hwnd, &procID); // Getting our Process ID, as an ex. like 000027AC
		HANDLE handle = OpenProcess(PROCESS_ALL_ACCESS, FALSE, procID); // Opening the Process with All Access

		if (procID == NULL) {
			cout << "Can't find Process." << endl;
			Sleep(2000); // Sleep 2 seconds
			exit(-1); // Exit the program if it did not find the Window
		}
		else {
			// Write the newValue into the Process Memory, 03007640 is the Address
			WriteProcessMemory(handle, (PBYTE*)0x03007640, &newValue, sizeof(newValue), 0);
			Sleep(5000); // Sleep 5 seconds
		}
	}
}