介绍
最近正试着从其他程序的listview控件中获取信息,因为需要传递一个指针以便存放取得的字符串,但Windows使用的是虚拟内存,指针是不允许跨进程访问的。
Windows是这样通过虚拟内存来管理分配给所有应用程序的内存的:它让程序认为自己拥有2GB的内存空间可用,它也通过保护来避免程序互相占用内存.这样当一个程序有问题时,不会影响到其他程序。
写了一些代码之后,我认识到我的指针是不允许的,所以无法工作。通过几个小时在MSDN上的发掘,我找到了这几个函数VirtualAllocEx(), VirtualFreeEx()
, WriteProcessMemory()
and ReadProcessMemory()
. 有了这些函数的武装,我修改了我的代码:
#define WIN32_LEAN_AND_MEAN #include <stdio.h> #include <windows.h> #include <commctrl.h> int main(void) { /* 找到在wnidows下运行的listview. */ HWND hwnd=FindWindow(NULL, "Stealing Program's Memory: ListView"); HWND listview=FindWindowEx(hwnd, NULL, "SysListView32", NULL); int count=(int)SendMessage(listview, LVM_GETITEMCOUNT, 0, 0); int i; char item[512], subitem[512]; /* 显示 listview 中的每一项以及它的子项 并且一个一个的打印出来. */ LVITEM lvi; lvi.cchTextMax=512; for(i=0; i<count; i++) { lvi.iSubItem=0; lvi.pszText=item; SendMessage(listview, LVM_GETITEMTEXT, (WPARAM)i, (LPARAM)&lvi); lvi.iSubItem=1; lvi.pszText=subitem; SendMessage(listview, LVM_GETITEMTEXT, (WPARAM)i, (LPARAM)&lvi); printf("%s - %s/n", item, subitem); } return 0; }就象我之前所说的,这无法工作,指向lvi,item和subitem的指针在跨进程访问时都出现了问题,如何解决呢?通过
WriteProcessMemory()和ReadProcessMemory()来使用其他程序的内存,在其他进程内实现LVM_GETITEMTEXT
并返回。从另外的程序内的listview控件读取items真象一个黑客。
首先,我们得到listview的进程,象下面这样:
unsigned long pid; HANDLE process; GetWindowThreadProcessId(listview, &pid); process=OpenProcess(PROCESS_VM_OPERATION|PROCESS_VM_READ| PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, FALSE, pid);
然后我们创建三个指针LVITEM *_lvi,
char *_item
, andchar *_subitem 用VirtualAllocEx()把它们分配到
另外程序的虚拟内存空间里。
LVITEM *_lvi=(LVITEM*)VirtualAllocEx(process, NULL, sizeof(LVITEM), MEM_COMMIT, PAGE_READWRITE); char *_item=(char*)VirtualAllocEx(process, NULL, 512, MEM_COMMIT, PAGE_READWRITE); char *_subitem=(char*)VirtualAllocEx(process, NULL, 512, MEM_COMMIT, PAGE_READWRITE);
现在,我们用lvi.pszText指向
_item并且用WriteMemoryProcess()把它的内存拷贝到_lvi
lvi.pszText=_item; WriteProcessMemory(process, _lvi, &lvi, sizeof(LVITEM), NULL);
现在我们有了一个LVITEM指针它在另外一个程序的虚拟内存空间是可以使用的,我们可以发送LVM_GETITEMTEXT消息给
listvie并且拷贝_item的文本到item中,这样我们就能在自己的程序里读取它。
SendMessage(hwnd, LVM_GETITEMTEXT, (WPARAM)i, (LPARAM)_lvi); ReadProcessMemory(process, _item, item, max, NULL);
在subitem中重复,然后释放我在其他程序里分配的内存:
VirtualFreeEx(process, _lvi, 0, MEM_RELEASE); VirtualFreeEx(process, _item, 0, MEM_RELEASE); VirtualFreeEx(process, _subitem, 0, MEM_RELEASE);
哈!一切OK,
#define WIN32_LEAN_AND_MEAN #include <stdio.h> #include <windows.h> #include <commctrl.h> int main(void) { HWND hwnd=FindWindow(NULL, "Stealing Program's Memory: ListView"); HWND listview=FindWindowEx(hwnd, NULL, "SysListView32", NULL); int count=(int)SendMessage(listview, LVM_GETITEMCOUNT, 0, 0); int i; LVITEM lvi, *_lvi; char item[512], subitem[512]; char *_item, *_subitem; unsigned long pid; HANDLE process; GetWindowThreadProcessId(listview, &pid); process=OpenProcess(PROCESS_VM_OPERATION|PROCESS_VM_READ| PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, FALSE, pid); _lvi=(LVITEM*)VirtualAllocEx(process, NULL, sizeof(LVITEM), MEM_COMMIT, PAGE_READWRITE); _item=(char*)VirtualAllocEx(process, NULL, 512, MEM_COMMIT, PAGE_READWRITE); _subitem=(char*)VirtualAllocEx(process, NULL, 512, MEM_COMMIT, PAGE_READWRITE); lvi.cchTextMax=512; for(i=0; i<count; i++) { lvi.iSubItem=0; lvi.pszText=_item; WriteProcessMemory(process, _lvi, &lvi, sizeof(LVITEM), NULL); SendMessage(listview, LVM_GETITEMTEXT, (WPARAM)i, (LPARAM)_lvi); lvi.iSubItem=1; lvi.pszText=_subitem; WriteProcessMemory(process, _lvi, &lvi, sizeof(LVITEM), NULL); SendMessage(listview, LVM_GETITEMTEXT, (WPARAM)i, (LPARAM)_lvi); ReadProcessMemory(process, _item, item, 512, NULL); ReadProcessMemory(process, _subitem, subitem, 512, NULL); printf("%s - %s/n", item, subitem); } VirtualFreeEx(process, _lvi, 0, MEM_RELEASE); VirtualFreeEx(process, _item, 0, MEM_RELEASE); VirtualFreeEx(process, _subitem, 0, MEM_RELEASE); return 0; }转自:http://blog.csdn.net/jia_xiaoxin/article/details/2916899