[英]Reading other process memory returns question marks
我正在使用其他内存扫描工具读取其他进程内存,然后在此简单的控制台应用程序中使用给定地址:
const int PROCESS_WM_READ = 0x0010;
[DllImport("kernel32.dll")]
public static extern IntPtr OpenProcess(int dwDesiredAccess, bool bInheritHandle, int dwProcessId);
[DllImport("kernel32.dll")]
public static extern bool ReadProcessMemory(int hProcess, int lpBaseAddress, byte[] lpBuffer, int dwSize, ref int lpNumberOfBytesRead);
static void Main(string[] args)
{
Process process = Process.GetProcessesByName("myProcess")[0];
IntPtr processHandle = OpenProcess(PROCESS_WM_READ, false, process.Id);
var ptr = int.Parse(Console.ReadLine(), NumberStyles.HexNumber);
Console.WriteLine($"ptr: {ptr}");
for (int i = 1; i < 129; i++)
{
int bytesRead = 0;
byte[] buffer = new byte[i];
try
{
ReadProcessMemory((int)processHandle, ptr, buffer, buffer.Length, ref bytesRead);
if (BitConverter.ToInt32(buffer, 0) == 0)
{
Console.WriteLine("error occured");
continue;
}
Console.WriteLine(bytesRead.ToString());
Console.WriteLine(Encoding.Unicode.GetString(buffer));
}
catch(Exception ex)
{
Console.WriteLine(ex.Message);
}
}
Console.ReadLine();
}
问题在于结果总是一定? ?? ?
? ?? ?
而不是我试图达到的诠释
我尝试了不同的编码
Console.WriteLine(Encoding.ASCII.GetString(buffer) + " (" + bytesRead.ToString() + "bytes)");
Console.WriteLine(Encoding.UTF8.GetString(buffer) + " (" + bytesRead.ToString() + "bytes)");
Console.WriteLine(Encoding.Default.GetString(buffer) + " (" + bytesRead.ToString() + "bytes)");
和缓冲区长度-这就是为什么存在循环
这可能是什么问题?
您可以将目标进程附加到Visual Studio,以查看要读取的地址中的值。 如果它们是有效数据,则可以这样打印:Console.WriteLine(buffer [0]);
以下是您可以参考的BingDict(32位)进程存储器的读取示例。
class Program
{
[DllImport("kernel32.dll")]
public static extern IntPtr OpenProcess(int dwDesiredAccess, bool bInheritHandle, int dwProcessId);
[DllImport("kernel32.dll")]
public static extern bool ReadProcessMemory(int hProcess, int lpBaseAddress, byte[] lpBuffer, int dwSize, ref int lpNumberOfBytesRead);
const int PROCESS_WM_READ = 0x0010;
static void Main(string[] args)
{
Process process = Process.GetProcessById(13568);
IntPtr processHandle = OpenProcess(PROCESS_WM_READ, false, process.Id);
// Get the process start information
ProcessStartInfo myProcessStartInfo = new ProcessStartInfo("BingDict");
// Assign 'StartInfo' of notepad to 'StartInfo' of 'process' object.
process.StartInfo = myProcessStartInfo;
//process.Start();
System.Threading.Thread.Sleep(1000);
ProcessModule myProcessModule;
// Get all the modules associated with the process
ProcessModuleCollection myProcessModuleCollection = process.Modules;
Console.WriteLine("Base addresses of the modules associated are:");
// Display the 'BaseAddress' of each of the modules.
for (int i = 0; i < myProcessModuleCollection.Count; i++)
{
myProcessModule = myProcessModuleCollection[i];
Console.WriteLine(myProcessModule.ModuleName + " : "
+ myProcessModule.BaseAddress);
}
// Get the main module associated with the process
myProcessModule = process.MainModule;
// Display the 'BaseAddress' of the main module.
Console.WriteLine("The process's main module's base address is: {0:X4}",
(int)myProcessModule.BaseAddress);
var ptr = (int)myProcessModule.BaseAddress;
for (int i = 1; i < 129; i++)
{
int bytesRead = 0;
byte[] buffer = new byte[1];
try
{
if (ReadProcessMemory((int)processHandle, ptr, buffer, buffer.Length, ref bytesRead))
{
Console.WriteLine(buffer[0]);
}
}
catch (Exception ex)
{
Console.WriteLine(ex.Message);
}
}
Console.ReadLine();
}
}
声明:本站的技术帖子网页,遵循CC BY-SA 4.0协议,如果您需要转载,请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.