使用 WriteProcessMemory 和指针写入另一个进程的内存

Question

可能有几个 post 以多种方式解释了我的问题...但我一直在 google 和 Whosebug 搜索框中搜索，但我没有找到任何东西。那我走了。

我想在进程内存中写入一个字符串，用 C++ 更改它，但我什至不清楚它是如何工作的所以..

我有这个指针： Image of the pointer 拜托，有人可以帮我做吗？

我已经试过了，但还是不行..

#include <windows.h> 
#include <iostream> 

int main() {
    HWND hWnd = FindWindow(0, "WindowName");
    if (hWnd == 0) {
        std::cout << "Cannot find window." << std::endl;
    }
    DWORD pId;
    GetWindowThreadProcessId(hWnd, &pId);
    HANDLE hProc = OpenProcess(PROCESS_ALL_ACCESS, FALSE, pId);
    DWORD baseAddress = 0x009B03D0;
    DWORD offset = 0xA7;
    DWORD ptrAddress;
    char *newString = "newvalue";
    ReadProcessMemory(hProc, (void*)baseAddress, &ptrAddress, sizeof(DWORD), 0);
    WriteProcessMemory(hProc, (void*)(ptrAddress + offset), newString, strlen(newString), 0);
    std::cout << "Done. " << &ptrAddress << std::endl;
    std::getchar();
}

我应该获取指针并跳到最后一个，因为我只有一个偏移量..但我没有得到正确的..

编辑：

这是我的新代码，在 WriteProcessMemory 函数之前一直有效。有什么问题吗？

实际有效的代码：

int main()
{
    unsigned long Pointer;   /* to hold the final value */
    unsigned long temp;      /* hold the temp values    */
    unsigned long address = 0x009B03D0;
    unsigned long offset = 0xA7;
    unsigned long newString = 0;
    DWORD pid;
    HWND hwnd;
    hwnd = FindWindow(0, TEXT("NewWindow"));
    if (!hwnd)
    {
        cout << "No!\n";
        cin.get();
    }
    else
    {
        GetWindowThreadProcessId(hwnd, &pid);
        HANDLE phandle = OpenProcess(PROCESS_ALL_ACCESS, 0, pid);
        if (!phandle)
        {
            cout << "None!\n";
            cin.get();
        }
        else
        {
            while (1)
            {

                ReadProcessMemory(phandle, reinterpret_cast<LPVOID>(address), &temp, sizeof(temp), 0);
                Pointer = temp + offset;
                //Good
                ReadProcessMemory(phandle, reinterpret_cast<LPVOID>(Pointer), &newString, 16, 0);
                cout << reinterpret_cast<LPVOID>(Pointer) << " en " << newString;
                Sleep(1000);
            }
            return 0;
        }
    }
}

无效的代码：

int main()
{
    unsigned int Pointer;   /* to hold the final value */
    unsigned int temp;      /* hold the temp values    */
    unsigned int address = 0x009B03D0;
    unsigned int offset = 0xA7;
    unsigned int newString = 1768060259;
    DWORD pid;
    HWND hwnd;
    hwnd = FindWindow(0, TEXT("NewWindow"));
    if (!hwnd)
    {
        cout << "NO\n";
        cin.get();
    }
    else
    {
        GetWindowThreadProcessId(hwnd, &pid);
        HANDLE phandle = OpenProcess(PROCESS_ALL_ACCESS, 0, pid);
        if (!phandle)
        {
            cout << "NONE\n";
            cin.get();
        }
        else
        {
            while (1)
            {

                ReadProcessMemory(phandle, reinterpret_cast<LPVOID>(address), &temp, sizeof(temp), 0);
                Pointer = temp + offset;
                //Good
                if (!WriteProcessMemory(phandle, reinterpret_cast<LPVOID>(Pointer), &newString, sizeof(newString), 0))
                    std::cerr << "Couldn't write process memory:" << GetLastError() << std::endl;
                cout << reinterpret_cast<LPVOID>(Pointer) << " en " << newString;
                Sleep(1000);
            }
            return 0;
        }
    }
}

Answer 1

每个进程都有自己的内存和地址space。所以 ReadProcessMemory() 和 WriteProcessMemory() 使用中间缓冲区来完成访问另一个进程内存的工作。

很遗憾，您的 ReadProcessMemory() 电话有问题：

你没有初始化ptrAddress指向缓冲区
你传递了 ptrAddress 的地址而不是它应该指向有效缓冲区的值
您传递 0（即 nullptr）而不是传递 zie 变量的地址，该地址应包含可读取的字节数。

另请注意，您使用 DWORD 对 LPCVOID 管理目标进程中的地址。第一个总是 32 位，而后者取决于您的编译选项（32 位代码或 64 位代码）。

您还应该验证 error code 以防失败。几乎可以肯定，在不同的进程中 read/write 需要特殊权限。

这里是经过调整的代码，其中包含一些诊断消息，可以进一步帮助您。

HWND hWnd = FindWindow(0, TEXT("WindowName") );
if (hWnd == 0) {
    std::cerr << "Cannot find window." << std::endl;
}
else {
    DWORD pId;
    GetWindowThreadProcessId(hWnd, &pId);
    HANDLE hProc = OpenProcess(PROCESS_ALL_ACCESS, FALSE, pId);
    if (hProc) {
        char *newString = "newvalue";
        size_t sz = strlen(newString) + 1; 
        LPVOID baseAddress = (LPVOID)0x009B03D0;
        DWORD offset = 0xA7;
        LPVOID ptrAddress = new char[sz];
        SIZE_T bytes_read = 0, bytes_written=0;
        if (ReadProcessMemory(hProc, baseAddress, ptrAddress, sz, &bytes_read) || GetLastError()== ERROR_PARTIAL_COPY) {
            if (bytes_read == 0)
                std::cerr << "Houston, we have a problem..." << std::endl; 
            if(!WriteProcessMemory(hProc, baseAddress, (LPCVOID)newString, sz, &bytes_written)) 
                std::cerr << "Couldn't write process memory:" << GetLastError() << std::endl;
            std::cout << "Done. " << bytes_read <<" bytes read and "<<bytes_written<<" bytes written"<< std::endl;
        }
        else {
            std::cerr<< "Couldn't read process memory:" << GetLastError() << std::endl;
        }
        delete[] ptrAddress; 
    }
    else {
        std::cerr << "Couldn't open process " << pId << ": " << GetLastError() << std::endl; 
    }
}
std::getchar();

使用 WriteProcessMemory 和指针写入另一个进程的内存

Write in another process' memory with WriteProcessMemory and a Pointer

c++

memory

pointers

process

windows-ce