内存修改器原理

BOOL
WINAPI
ReadProcessMemory(
                  HANDLE hProcess,    //待读进程的句柄
                  LPCVOID lpBaseAddress,    //目标进程中待读内存的起始地址
                  LPVOID lpBuffer,    //用来读取数据的缓冲区
                  DWORD nSize,    //要读取的字节数
                  LPDWORD lpNumberOfBytesRead    //用来供函数返回实际读取的字节数         
    );
//参数同上
BOOL
WINAPI
WriteProcessMemory(
                   HANDLE hProcess,
                   LPVOID lpBaseAddress,
                   LPVOID lpBuffer,
                   DWORD nSize,
                   LPDWORD lpNumberOfBytesWritten
                   );

下面是利用上面的两个API写的内存修改器

#include "stdafx.h"

#include <windows.h>

#include <tchar.h>

DWORD g_arList[1024];

int g_nListCnt;

HANDLE g_hProcess;

BOOL WriteMemory(DWORD dwAddr, DWORD dwValue);

void ShowList(void);

BOOL CompareAPage(DWORD dwBaseAddr, DWORD dwValue);

BOOL FindNext(DWORD dwValue);

BOOL FindFirst(DWORD dwValue);

BOOL FindFirst(DWORD dwValue)

{

const DWORD dwOneGB = 1024 * 1024 * 1024;

const DWORD dwOnePage = 4 * 1024;

if (NULL == g_hProcess)

{

return FALSE;

}

DWORD dwBase;

OSVERSIONINFO vi = {sizeof(vi)};

::GetVersionEx(&vi);

if (VER_PLATFORM_WIN32_WINDOWS == vi.dwPlatformId)

{

dwBase = 4 * 1024 * 1024;

}

else

{

dwBase = 640 * 1024;

}

for (; dwBase < 2 * dwOneGB; dwBase += dwOnePage)

{

CompareAPage(dwBase, dwValue);

}

return TRUE;

}

BOOL CompareAPage(DWORD dwBaseAddr, DWORD dwValue)

{

BYTE arBytes[4096];

if (!::ReadProcessMemory(g_hProcess, (LPVOID)dwBaseAddr, arBytes, 4096, NULL))

{

return FALSE;

}

DWORD* pdw = NULL;

int i = 0;

for (i = 0;i < (int)4 * 1024 -3; i++)

{

pdw = (DWORD*)&arBytes[i];

if (pdw[0] == dwValue)

{

if (g_nListCnt >= 1024)

{

return FALSE;

}

g_arList[g_nListCnt++] = dwBaseAddr + i;

}

}

return TRUE;

}

void ShowList(void)

{

int i;

for (i = 0; i < g_nListCnt; i++)

{

printf("lX/n", g_arList[i]);

}

}

BOOL FindNext(DWORD dwValue)

{

int nOrgCnt = g_nListCnt;

g_nListCnt = 0;

BOOL bRet = FALSE;

DWORD dwReadValue;

int i;

for (i = 0; i < nOrgCnt; i++)

{

if (::ReadProcessMemory(g_hProcess, (LPVOID)g_arList[i], &dwReadValue, sizeof(DWORD), NULL))

{

if (dwReadValue == dwValue)

{

g_arList[g_nListCnt++] = g_arList[i];

bRet = TRUE;

}

}

}

return bRet;

}

BOOL WriteMemory(DWORD dwAddr, DWORD dwValue)

{

return ::WriteProcessMemory(g_hProcess, (LPVOID)dwAddr, &dwValue, sizeof(DWORD), NULL);

}

int main(int argc, char* argv[])

{

TCHAR szFileName[] = _T("../Debug/Testor0.exe");

STARTUPINFO si = {sizeof(si)};

PROCESS_INFORMATION pi;

::CreateProcess(NULL, szFileName, NULL, NULL, FALSE, CREATE_NEW_CONSOLE, NULL, NULL, &si, π);

::CloseHandle(pi.hThread);

g_hProcess = pi.hProcess;

int iVal;

printf("Input val = ");

scanf("%d", &iVal);

FindFirst(iVal);

ShowList();

 

if (g_nListCnt > 1)

{

printf("Input val = ");

scanf("%d", &iVal);

FindNext(iVal);

ShowList();

}

 

printf("New value = ");

scanf("%d", &iVal);

if (WriteMemory(g_arList[0], iVal))

{

printf("Write data success./n");

}

::CloseHandle(g_hProcess);

return 0;

}