能力值:
( LV2,RANK:10 )
|
-
-
2 楼
可以去下CE的代码看看嘛~~
|
能力值:
( LV2,RANK:10 )
|
-
-
3 楼
同问,Delphi代码看着累...
|
能力值:
( LV2,RANK:10 )
|
-
-
4 楼
以前写的
void FindMemory(DWORD pid)
{
MEMORY_BASIC_INFORMATION mbi;
DWORD memoryAddress = 0;
BYTE *dataBuffer = NULL;
BOOL readReturn = 0;
HANDLE pHandle=OpenProcess(PROCESS_ALL_ACCESS, 0, pid);
while (VirtualQueryEx(pHandle, (LPVOID)memoryAddress, &mbi, sizeof(mbi)))
{
if (mbi.Type == MEM_PRIVATE && mbi.Protect != PAGE_EXECUTE && mbi.Protect != PAGE_NOACCESS && mbi.Protect != 128)
{
dataBuffer = (BYTE*)malloc(mbi.RegionSize);
readReturn=ReadProcessMemory(pHandle, (LPVOID)memoryAddress, dataBuffer, mbi.RegionSize, 0);
if (readReturn != 0)
{
//在dataBuffer寻找字节集返回找到位置+memoryAddress=实际地址
for (int i = 0; i < mbi.RegionSize; i++)
{
//寻找自定义字节自己写把
if (dataBuffer[i] == 144 && dataBuffer[i+1] == 108)
{
cout <<"找到"<< hex << memoryAddress+i << endl;
}
}
}
}
memoryAddress = memoryAddress + mbi.RegionSize;
}
CloseHandle(pHandle);
}
|
能力值:
( LV9,RANK:190 )
|
-
-
5 楼
你不是说了:1.可执行内存属性 2.非PE映像的内存。这两点 已经把可以搜索的范围缩得很小了,再配上 机器码特征
|
能力值:
( LV4,RANK:50 )
|
-
-
6 楼
赞一个思路
|
|
|