栏目分类:
子分类:
返回
名师互学网用户登录
快速导航关闭
当前搜索
当前分类
子分类
实用工具
热门搜索
名师互学网 > IT > 软件开发 > 后端开发 > .Net

c#设计的通过程序名称获取基址和循环读取内存

.Net 更新时间: 发布时间: IT归档 最新发布 模块sitemap 名妆网 法律咨询 聚返吧 英语巴士网 伯小乐 网商动力

c#设计的通过程序名称获取基址和循环读取内存

1.效果图


2.源码
```csharp
public abstract class HelpUtil
    {
        [DllImportAttribute("kernel32.dll", EntryPoint = "ReadProcessMemory")]
        public static extern bool ReadProcessMemory(
            IntPtr hProcess,
            IntPtr lpBaseAddress,
            IntPtr lpBuffer,
            int nSize,
            IntPtr lpNumberOfBytesRead
            );
        [DllImportAttribute("kernel32.dll", EntryPoint = "OpenProcess")]
        public static extern IntPtr OpenProcess(
            int dwDesiredAccess,
            bool bInheritHandle,
            int dwProcessId
            );
        [DllImport("kernel32.dll")]
        private static extern void CloseHandle(
            IntPtr hObject
            );
        //写内存
        [DllImportAttribute("kernel32.dll", EntryPoint = "WriteProcessMemory")]
        public static extern bool WriteProcessMemory(
            IntPtr hProcess,
            IntPtr lpBaseAddress,
            int[] lpBuffer,
            int nSize,
            IntPtr lpNumberOfBytesWritten
            );
        //获取窗体的进程标识ID
        public static int GetPid(string windowTitle)
        {
            int rs = 0;
            Process[] arrayProcess = Process.GetProcesses();
            foreach (Process p in arrayProcess)
            {
                if (p.MainWindowTitle.IndexOf(windowTitle) != -1)
                {
                    rs = p.Id;
                    break;
                }
            }
            return rs;
        }

        //根据进程名称获取PID
        public static int GetPidByProcessName(string processName)
        {
            Process[] arrayProcess = Process.GetProcessesByName(processName);
            foreach (Process p in arrayProcess)
            {
                return p.Id;
            }
            return 0;
        }

        //根据窗体标题查找窗口句柄(支持模糊匹配)
        public static IntPtr FindWindow(string title)
        {
            Process[] ps = Process.GetProcesses();
            foreach (Process p in ps)
            {
                if (p.MainWindowTitle.IndexOf(title) != -1)
                {
                    return p.MainWindowHandle;
                }
            }
            return IntPtr.Zero;
        }

        //读取内存中的值
        [System.Runtime.ExceptionServices.HandleProcessCorruptedStateExceptions]
        public static int ReadMemoryValue(long baseAddress, string processName)
        {
            try
            {
                byte[] buffer = new byte[4];
                IntPtr byteAddress = Marshal.UnsafeAddrOfPinnedArrayElement(buffer, 0);//获取缓冲区地址
                IntPtr hProcess = OpenProcess(0x1F0FFF, false, GetPidByProcessName(processName));
                ReadProcessMemory(hProcess, (IntPtr)baseAddress, byteAddress, 4, IntPtr.Zero); //将制定内存中的值读入
                CloseHandle(hProcess);
                return Marshal.ReadInt32(byteAddress);
            }
            catch (System.AccessViolationException)
            {
                return 0;
            }
        }
        //将值写入指定内存地址中
        public static void WriteMemoryValue(int baseAddress, string processName, int value)
        {
            IntPtr hProcess = OpenProcess(0x1F0FFF, false, GetPidByProcessName(processName)); //0x1F0FFF 最高权限
            WriteProcessMemory(hProcess, (IntPtr)baseAddress, new int[] { value }, 4, IntPtr.Zero);
            CloseHandle(hProcess);
        }
    }
```csharp
public partial class Form1 : Form
    {
        public Form1()
        {
            InitializeComponent();
        }

        private void btn_findBaseAddress_Click(object sender, EventArgs e)
        {
            findBasicAddress();
        }

        private string processName = "";

        //找基址
        public void findBasicAddress()
        {
            processName = "";
            this.txt_baseAddress.Text = "";
            if (string.IsNullOrEmpty(processName))
            {
                processName = this.com_processName.Text.Trim();
            }

            Process[] ps = Process.GetProcesses();//遍历所有的进程
            foreach (Process p in ps)
            {
                if (p.ProcessName == processName)
                {
                    for (int i = 0; i < p.Modules.Count; i++)
                    {
                        if (p.Modules[i].ModuleName == (processName+".exe"))
                        {
                            this.txt_baseAddress.Text = "0X" + p.Modules[i].EntryPointAddress.ToString("X8");
                            //basicAddress = System.Convert.ToInt32(aa, 16);
                        }
                    }
                }
            }
        }

        private void btn_readMemoryValue_Click(object sender, EventArgs e)
        {
            if (string.IsNullOrEmpty(this.txt_baseAddress.Text))
            {
                MessageBox.Show("请先获取基址","提示");
                return;
            }

            readData();
        }

        public void readData()
        {
            clearData();
            long basicAddress= System.Convert.ToInt64(this.txt_baseAddress.Text, 16);

            for (int i = 1; i < int.Parse(this.txt_count.Text); i++)
            {
                DataRow row = dtSource.NewRow();
                //row["memoryAddress"] = (basicAddress+i).ToString("X8");
                row["memoryAddress"] = (basicAddress + i).ToString("X8");
                row["storageValue"] = HelpUtil.ReadMemoryValue(basicAddress + i, processName);
                dtSource.Rows.Add(row);
                dtSource.AcceptChanges();
            }
            this.grd_viewData.DataSource = dtSource;
            this.grd_viewData.Refresh();

        }
        private void clearData()
        {
            if (dtSource.Rows.Count > 0)
            {
                dtSource.Rows.Clear();
                this.grd_viewData.DataSource = dtSource;
            }
        }

        private void Form1_Load(object sender, EventArgs e)
        {
            
            //初始化下拉框
            initDataTable();


            initComboBox();
        }

        private void initComboBox()
        {
            Process[] ps = Process.GetProcesses();//遍历所有的进程
            foreach(Process p in ps)
            {
                DataRow row = dtcomProcessName.NewRow();
                row["Name"] = p.ProcessName;
                row["Code"] = p.ProcessName;
                dtcomProcessName.Rows.Add(row);
                dtcomProcessName.AcceptChanges();
            }
            DataTable dtcopy = dtcomProcessName.Clone();

            DataView dv = dtcomProcessName.DefaultView;
            dv.Sort = "Name";
            dtcopy = dv.ToTable();

            this.com_processName.DisplayMember = "Name";
            this.com_processName.ValueMember = "Code";
            this.com_processName.DataSource = dtcopy;
        }

        private DataTable dtSource = new DataTable();
        private DataTable dtcomProcessName = new DataTable();
        private void initDataTable()
        {

            for(int i = 0; i < this.grd_viewData.Columns.Count; i++)
            {
                dtSource.Columns.Add(this.grd_viewData.Columns[i].Name);
            }

            dtcomProcessName.Columns.Add("Name");
            dtcomProcessName.Columns.Add("Code");
        }
    }
转载请注明:文章转载自 www.mshxw.com
本文地址:https://www.mshxw.com/it/907591.html
我们一直用心在做
关于我们 文章归档 网站地图 联系我们

版权所有 (c)2021-2022 MSHXW.COM

ICP备案号:晋ICP备2021003244-6号