Question

所以我在x86上运行了2年这段代码，两周前我尝试将它编译到任何CPU。它不起作用。我做了一些阅读，但没有找到任何东西。我是初学者，如果你想帮助我，我会很感激。

 <StructLayout(LayoutKind.Sequential)>
Public Structure MEMORY_BASIC_INFORMATION
    Public BaseAddress As Integer
    Public AllocationBase As Integer
    Public AllocationProtect As Integer
    Public RegionSize As Integer
    Public State As Integer
    Public Protect As Integer
    Public lType As Integer
End Structure
<StructLayout(LayoutKind.Sequential)>
Public Structure SYSTEM_INFO
    Dim dwOemID As Integer
    Dim dwPageSize As Integer
    Dim lpMinimumApplicationAddress As Integer
    Dim lpMaximumApplicationAddress As Integer
    Dim dwActiveProcessorMask As Integer
    Dim dwNumberOrfProcessors As Integer
    Dim dwProcessorType As Integer
    Dim dwAllocationGranularity As Integer
    Dim dwReserved As Integer
End Structure
<DllImport("kernel32.dll", EntryPoint:="VirtualQueryEx", SetLastError:=True), SuppressUnmanagedCodeSecurity()>
Public Function VirtualQueryEx(ByVal hProcess As IntPtr, ByVal lpAddress As UInteger, ByRef lpBuffer As MEMORY_BASIC_INFORMATION, ByVal dwLength As Integer) As Integer
End Function
<DllImport("kernel32.dll", EntryPoint:="GetSystemInfo", SetLastError:=True), SuppressUnmanagedCodeSecurity()>
Public Sub GetSystemInfo(ByRef lpSystemInfo As SYSTEM_INFO)
End Sub
<DllImport("kernel32.dll", EntryPoint:="OpenProcess", SetLastError:=True), SuppressUnmanagedCodeSecurity()>
Public Function OpenProcess(ByVal dwDesiredAccess As Integer, ByVal blnheritHandle As Boolean, ByVal dwAppProcessId As Integer) As IntPtr
End Function
<DllImport("kernel32.dll", EntryPoint:="CloseHandle", SetLastError:=True), SuppressUnmanagedCodeSecurity()>
Public Function CloseHandle(ByVal hObject As IntPtr) As <MarshalAs(UnmanagedType.Bool)> Boolean
End Function
<DllImport("kernel32.dll", EntryPoint:="ReadProcessMemory", SetLastError:=True), SuppressUnmanagedCodeSecurity()>
Public Function ReadProcessMemory(ByVal hProcess As IntPtr, ByVal lpBaseAddress As IntPtr, ByVal lpBuffer() As Byte, ByVal iSize As Integer, ByRef lpNumberOfBytesRead As Integer) As Boolean
End Function
Public Const PROCESS_VM_READ = (&H10)
Public Const PROCESS_VM_OPERATION = (&H8)
Public Const PROCESS_QUERY_INFORMATION = (&H400)
Public Const PROCESS_READ_WRITE_QUERY = PROCESS_VM_READ + PROCESS_VM_OPERATION + PROCESS_QUERY_INFORMATION

        Public Sub Test2()
        Dim _targetProcessHandle As IntPtr = System.Diagnostics.Process.GetProcesses("solitaire")(0).Handle
        Dim _mbi As MEMORY_BASIC_INFORMATION, _sysInfo As SYSTEM_INFO
        Dim _mbiSize As Int32 = System.Runtime.InteropServices.Marshal.SizeOf(_mbi)
        GetSystemInfo(_sysInfo)
        Dim _addr As Integer = _sysInfo.lpMinimumApplicationAddress
        Dim _readBuff(_sysInfo.dwPageSize - 1) As Byte
        Dim _actualBytesRead As Int32 = 0
        Dim _oldPageProtection As UInt32 = 0
        Dim _accessRightsChanged As Boolean = False
        _targetProcessHandle = OpenProcess(PROCESS_READ_WRITE_QUERY, False, CInt(_targetProcessHandle))
        Dim ret As Integer
        Do
            ret = VirtualQueryEx(_targetProcessHandle, CType(_addr, IntPtr), _mbi, _mbiSize)
            If ret = _mbiSize Then
                If ((_mbi.lType = &H20000) And (_mbi.State = &H1000) And (_mbi.RegionSize > 0)) Then
                    Dim _byteBuff(_mbi.RegionSize) As Byte
                    ReadProcessMemory(_targetProcessHandle, _mbi.BaseAddress, _byteBuff, _mbi.RegionSize, 0)
                    'Do some work
                    Array.Clear(_byteBuff, 0, _byteBuff.Length)
                End If
                _addr = _mbi.BaseAddress + _mbi.RegionSize
            End If
        Loop While _addr < _sysInfo.lpMaximumApplicationAddress
        CloseHandle(_targetProcessHandle)
    End Sub

这在X86上运行得很好，但它不想在AnyCpu上运行。你能帮我吗？提前谢谢。

Answer 1

你得到了badimageformatexception吗？我假设您正在加载x86 dll并尝试在x64机器上运行它，如果cpu是x64，任何cpu都会强制程序在x64中运行。强制您的程序到x86仍然可以在x64机器上运行。

VB.NET ANYCPU ReadProcessMemory

1 个答案: