内存查找进程的数字,功能实现了,但是速度慢,有待改进。CE为什么那么快?
#define _CRT_SECURE_NO_WARNINGS
#include<iostream>
#include <fstream>
#include<windows.h>
#include<tlhelp32.h>
#include <string.h>
using namespace std;
#if defined(_MSC_VER)
#define strcasecmp _stricmp
#endif
int main()
{
char app[1024];
cout << "请输入进程名\n如: ctfmon.exe\n:";
cin >> app;
BOOL flag = 0;
HANDLE htoken;
TOKEN_PRIVILEGES tkp;
OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &htoken);
LookupPrivilegeValue(NULL, SE_DEBUG_NAME, &tkp.Privileges[0].Luid);
tkp.PrivilegeCount = 1;
tkp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
AdjustTokenPrivileges(htoken, 0, &tkp, NULL, NULL, 0);
CloseHandle(htoken);
PROCESSENTRY32 pe32;
pe32.dwSize = sizeof(pe32);
HANDLE hprosnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
if (hprosnap == INVALID_HANDLE_VALUE)
{
cout << "Snapshot failed!" << endl;
}
if (Process32First(hprosnap, &pe32))
{
do
{
char tempstr[260];
wcstombs(tempstr, pe32.szExeFile, sizeof(pe32.szExeFile));
if (!strcasecmp(app, tempstr))
{
cout << "Program is dumping..." << endl;
flag = true;
break;
}
} while (::Process32Next(hprosnap, &pe32));
}
CloseHandle(hprosnap);
if (!flag)
{
cout << "Process not found!\n";
system("pause");
return 1;
}
SYSTEM_INFO si;
GetSystemInfo(&si);
//si.dwPageSize = 2046;
HANDLE htarget = OpenProcess(PROCESS_ALL_ACCESS, 0, pe32.th32ProcessID);
if (htarget == NULL)
{
cout << "Open Process Error!\n";
system("pause");
return 2;
}
MEMORY_BASIC_INFORMATION mbi;
char *onepagebuf = new char[si.dwPageSize];
for (DWORD start = (DWORD)si.lpMinimumApplicationAddress; start<(DWORD)si.lpMaximumApplicationAddress - si.dwPageSize; start += si.dwPageSize)
{
// hProcess[in]远程进程句柄。 被读取者
// pvAddressRemote[in]远程进程中内存地址。 从具体何处读取
// pvBufferLocal[out]本地进程中内存地址.函数将读取的内容写入此处
// dwSize[in]要传送的字节数。要写入多少
// pdwNumBytesRead[out]实际传送的字节数.函数返回时报告实际写入多少
if (!VirtualQueryEx(htarget, (void *)start, &mbi, sizeof(mbi)) == sizeof(mbi))
break;
if (mbi.State == MEM_COMMIT && mbi.Protect== PAGE_READWRITE)//只在可读写区查找
{
// 进程句柄
ReadProcessMemory(htarget, (void *)start, onepagebuf, si.dwPageSize, NULL);
DWORD endi=start+si.dwPageSize;
DWORD starti = start;
while (starti < endi)
{
int * valuebuf=new int();
ReadProcessMemory(htarget, (void *)starti, valuebuf, sizeof(valuebuf), NULL);
if (*valuebuf == 25)
{
printf("25找到了在%p\n", starti);
}
starti++;
}
}
}
cout << "done\n";
CloseHandle(htarget);
delete[]onepagebuf;
system("pause");
return 0;
}