這是我的界面圖:
程序代碼:
MemoRepairDlg.h:
// MemoRepairDlg.h : 頭文件
// #pragma once #include "afxwin.h" // CMemoRepairDlg 對話框 class CMemoRepairDlg : public CDialogEx { // 構(gòu)造 public: CMemoRepairDlg(CWnd* pParent = NULL); // 標準構(gòu)造函數(shù) ~CMemoRepairDlg(); //析構(gòu)函數(shù),釋放進程句柄 // 對話框數(shù)據(jù) enum { IDD = IDD_MEMOREPAIR_DIALOG }; protected: virtual void DoDataExchange(CDataExchange* pDX); // DDX/DDV 支持 // 實現(xiàn) protected: HICON m_hIcon; // 生成的消息映射函數(shù) virtual BOOL OnInitDialog(); afx_msg void OnPaint(); afx_msg HCURSOR OnQueryDragIcon(); DECLARE_MESSAGE_MAP() public: afx_msg void OnBnClickedButton1(); afx_msg void OnBnClickedButton2(); public: DWORD addrList[1024]; //地址列表 int addrCount; //有效地址個數(shù) HANDLE hProcess; //目標進程句柄 BOOL conFirst; //第一次查找 public: BOOL FirstFind(DWORD valueChange); BOOL NextFind(DWORD valueChange); BOOL WriteMemory(DWORD valueAddr, DWORD valueChange); BOOL ComparePage(DWORD baseAddr, DWORD valueChange); void ShowList(); afx_msg void OnBnClickedStartprocess(); CEdit editBox1; CEdit editBox2; CEdit editBox3; int editValue; int editValue3; CString editStr; };
MemoRepairDlg.cpp:
// MemoRepairDlg.cpp : 實現(xiàn)文件
// #include "stdafx.h" #include "MemoRepair.h" #include "MemoRepairDlg.h" #include "afxdialogex.h" #ifdef _DEBUG #define new DEBUG_NEW #endif // CMemoRepairDlg 對話框 CMemoRepairDlg::CMemoRepairDlg(CWnd* pParent /*=NULL*/) : CDialogEx(CMemoRepairDlg::IDD, pParent) , editValue(0) , editValue3(0) , editStr(_T("")) { m_hIcon = AfxGetApp()->LoadIcon(IDR_MAINFRAME); addrCount = 0; conFirst = TRUE; } void CMemoRepairDlg::DoDataExchange(CDataExchange* pDX) { CDialogEx::DoDataExchange(pDX); DDX_Control(pDX, IDC_EDIT1, editBox1); DDX_Control(pDX, IDC_EDIT2, editBox2); DDX_Control(pDX, IDC_EDIT3, editBox3); DDX_Text(pDX, IDC_EDIT2, editValue); DDX_Text(pDX, IDC_EDIT3, editValue3); DDX_Text(pDX, IDC_EDIT1, editStr); } BEGIN_MESSAGE_MAP(CMemoRepairDlg, CDialogEx) ON_WM_PAINT() ON_WM_QUERYDRAGICON() ON_BN_CLICKED(IDC_BUTTON1, &CMemoRepairDlg::OnBnClickedButton1) ON_BN_CLICKED(IDC_BUTTON2, &CMemoRepairDlg::OnBnClickedButton2) ON_BN_CLICKED(IDC_StartProcess, &CMemoRepairDlg::OnBnClickedStartprocess) END_MESSAGE_MAP() // CMemoRepairDlg 消息處理程序 BOOL CMemoRepairDlg::OnInitDialog() { CDialogEx::OnInitDialog(); // 設置此對話框的圖標。當應用程序主窗口不是對話框時,框架將自動 // 執(zhí)行此操作 SetIcon(m_hIcon, TRUE); // 設置大圖標 SetIcon(m_hIcon, FALSE); // 設置小圖標 // TODO: 在此添加額外的初始化代碼 return TRUE; // 除非將焦點設置到控件,否則返回 TRUE } // 如果向?qū)υ捒蛱砑幼钚』粹o,則需要下面的代碼 // 來繪制該圖標。對于使用文檔/視圖模型的 MFC 應用程序, // 這將由框架自動完成。 void CMemoRepairDlg::OnPaint() { if (IsIconic()) { CPaintDC dc(this); // 用于繪制的設備上下文 SendMessage(WM_IconERASEBKGND, reinterpret_cast<WPARAM>(dc.GetSafeHdc()), 0); // 使圖標在工作區(qū)矩形中居中 int cxIcon = GetSystemMetrics(SM_CXICON); int cyIcon = GetSystemMetrics(SM_CYICON); CRect rect; GetClientRect(&rect); int x = (rect.Width() - cxIcon + 1) / 2; int y = (rect.Height() - cyIcon + 1) / 2; // 繪制圖標 dc.DrawIcon(x, y, m_hIcon); } else { CDialogEx::OnPaint(); } } //當用戶拖動最小化窗口時系統(tǒng)調(diào)用此函數(shù)取得光標 //顯示。 HCURSOR CMemoRepairDlg::OnQueryDragIcon() { return static_cast<HCURSOR>(m_hIcon); } void CMemoRepairDlg::OnBnClickedButton1() { // TODO: 在此添加控件通知處理程序代碼 int value; //查找的值 UpdateData(TRUE); value = editValue; if (conFirst == TRUE) { FirstFind(value); //進行第一次查找 ShowList(); //打印出結(jié)果 conFirst = FALSE; } else { NextFind(value); //進行下一次查找 ShowList(); //打印出結(jié)果 } if (addrCount == 1) { MessageBox("OK, You Can Change Now!"); } else MessageBox("NO, You Can't Change!"); } void CMemoRepairDlg::OnBnClickedButton2() { // TODO: 在此添加控件通知處理程序代碼 if (addrCount > 1 || addrCount == 0) { MessageBox("Please Search Again!"); } else { int valueWillChange; //要修改的值 UpdateData(TRUE); valueWillChange = editValue3; WriteMemory(addrList[0], valueWillChange); } } void CMemoRepairDlg::OnBnClickedStartprocess() { // TODO: 在此添加控件通知處理程序代碼 char szFileName[] = "Testor.exe"; STARTUPINFO starUpInfo = {sizeof(starUpInfo)}; PROCESS_INFORMATION process_information; //啟動測試程序進程 ::CreateProcess(NULL, szFileName, NULL, NULL, FALSE,CREATE_NEW_CONSOLE, NULL, NULL, &starUpInfo, &process_information); //關閉線程句柄 ::CloseHandle(process_information.hThread); hProcess = process_information.hProcess; } CMemoRepairDlg::~CMemoRepairDlg() { ::CloseHandle(hProcess); } BOOL CMemoRepairDlg::ComparePage(DWORD baseAddr, DWORD valueChange) { BYTE pageByte[4096]; if (!::ReadProcessMemory(hProcess,(LPVOID)baseAddr, pageByte,4096,NULL)) { return FALSE; //此頁不可讀 } //在這頁中查找 DWORD* pageDword; for(int i=0; i<(int)4*1024; i++) { pageDword = (DWORD*)&pageByte[i]; if (pageDword[0] == valueChange) { if (addrCount >= 1024) { return FALSE; } //添加到全局變量中 addrList[addrCount] = baseAddr + i; addrCount++; } } } BOOL CMemoRepairDlg::FirstFind(DWORD valueChange) { const DWORD dwOneGB = 1024*1024*1024; const DWORD dwOnePage = 4096; if (hProcess == NULL) { return FALSE; } //操作系統(tǒng)類型 DWORD systemBase; OSVERSIONINFO vinfo ={sizeof(vinfo)}; ::GetVersionEx(&vinfo); if (vinfo.dwPlatformId == VER_PLATFORM_WIN32_WINDOWS) { systemBase = 4*1024*1024; } else { systemBase = 640*1024; } //在開始地址到2GB的地址空間查找 for (; systemBase < 2*dwOneGB; systemBase += dwOnePage) { ComparePage(systemBase, valueChange); } return TRUE; } BOOL CMemoRepairDlg::NextFind(DWORD valueChange) { //保存地址個數(shù),初始化addrCount的值 int mOrgCnt = addrCount; addrCount = 0; BOOL bRet = FALSE; DWORD dwReadValue; for (int i=0; i<mOrgCnt; i++) { if (::ReadProcessMemory(hProcess,(LPVOID)addrList[i],&dwReadValue,sizeof(DWORD),NULL)) { if (dwReadValue == valueChange) { addrList[addrCount] = addrList[i]; addrCount++; bRet = TRUE; } } } return bRet; } void CMemoRepairDlg::ShowList() { editStr =""; CString str=""; UpdateData(FALSE); editStr.Format("%d個相同的地址.",addrCount); for(int i=0; i<addrCount; i++) { str.Format("%s %d '\n';",editStr, addrList[i]); editStr = str; } UpdateData(FALSE); } BOOL CMemoRepairDlg::WriteMemory(DWORD valueAddr, DWORD valueChange) { return ::WriteProcessMemory(hProcess, (LPVOID)valueAddr, &valueChange, sizeof(DWORD), NULL); }
再就是新建一個程序,作為啟動的進程程序:Testor
這個程序的Testor.exe文件將影響到上面啟動進程的路徑。 Testor.cpp:
#include <iostream>
using namespace std; int ChangeNum = 0; //全局變量 int main() { int insideNum = 200; //局部變量 ChangeNum = 1600; while (true) { printf(" insideNum = %d, addr = %X; ChangeNum = %d, addr = %X \n", ++insideNum, &insideNum, ++ChangeNum, &ChangeNum); getchar(); } return 0; }
運行過程圖:
至于實現(xiàn)原理:我感覺最奇妙的是那兩次搜索。兩次搜索就像坐標一樣,能找到具體的地址。