// SoCool.cpp: 定义控制台应用程序的入口点。
//
#include "stdafx.h"
#include <Windows.h>
#include <TlHelp32.h> // enum all process
HANDLE g_hProcess = INVALID_HANDLE_VALUE;
DWORD g_dwValueAddr[1024] = { 0 };
DWORD g_dwListCount = 0;
BOOL CompareAPage(DWORD dwAddr,DWORD dwValue)
{
BYTE arrayByte[4096] = { 0 };
ReadProcessMemory(g_hProcess,(LPCVOID)dwAddr, arrayByte, 4096, nullptr);
DWORD *pDword = nullptr;
for (int nIndex = 0; nIndex < 4096-3; nIndex++)
{
pDword = (DWORD*)&arrayByte[nIndex];
if (*pDword==dwValue)
{
if (g_dwListCount>=1024)
{
return false;
}
g_dwValueAddr[g_dwListCount++] = dwAddr + nIndex;
}
}
return TRUE;
}
BOOL FindFirstMemory(DWORD dwValue)
{
const DWORD dwOneGB = 1024 * 1024 * 1024;
if (nullptr==g_hProcess)
{
return false;
}
for (DWORD dwBase = 640*1024; dwBase < 2*dwOneGB; dwBase+=(4*1024))
{
CompareAPage(dwBase,dwValue);
}
return TRUE;
}
BOOL FindNext(DWORD dwValue)
{
int nListCount = g_dwListCount;
g_dwListCount = 0;
DWORD dwFindValue = 0;
BOOL bRet = false;
for (int nIndex = 0; nIndex < nListCount; nIndex++)
{
if (ReadProcessMemory(g_hProcess,(LPVOID)g_dwValueAddr[nIndex],&dwFindValue,sizeof(dwFindValue),nullptr))
{
if (dwFindValue==dwValue)
{
g_dwValueAddr[g_dwListCount++] = g_dwValueAddr[nIndex];
bRet = true;
}
}
}
return bRet;
}
int main(int argc,char* argv[])
{
PROCESSENTRY32 pe32 = { 0 };
pe32.dwSize = sizeof(pe32);
HANDLE hProcessSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, NULL);
BOOL bMore = Process32First(hProcessSnap, &pe32);
while (bMore)
{
printf("ProcessName:%50ws\tPID:%d\r\n", pe32.szExeFile, pe32.th32ParentProcessID);
bMore = Process32Next(hProcessSnap, &pe32);
}
printf("input target PID:\r\n");
DWORD dwPID = 0;
scanf("%d", &dwPID);
g_hProcess = OpenProcess(PROCESS_ALL_ACCESS, false, dwPID);
if (INVALID_HANDLE_VALUE != g_hProcess)
{
printf("Please input the value your want to find:\r\n");
DWORD dwValue = 0;
scanf("%d", &dwValue);
FindFirstMemory(dwValue);
for (int nIndex = 0; nIndex < g_dwListCount; nIndex++)
{
printf("find address:%08X\r\n", g_dwValueAddr[nIndex]);
}
printf("total find %d \r\n", g_dwListCount);
while (1<g_dwListCount)
{
printf("Please input the value your want to find:\r\n");
DWORD dwValue = 0;
scanf("%d", &dwValue);
FindNext(dwValue);
for (int nIndex = 0; nIndex < g_dwListCount; nIndex++)
{
printf("find address:%08X\r\n", g_dwValueAddr[nIndex]);
}
}
printf("Please input the value your want to find:\r\n");
dwValue = 0;
scanf("%d", &dwValue);
WriteProcessMemory(g_hProcess, (LPVOID)g_dwValueAddr[0],&dwValue,sizeof(dwValue),nullptr);
}
//ReadProcessMemory()
system("pause");
return 0;
}