Question

我使用下面的方法读取内存中的字节。我想读取彼此非常接近的内存地址中的值。以前我一直在为内存中的每个字节进行单独调用，并使用for循环将结果添加到数组中。这变得非常低效，所以我想调整下面的代码来读取大块内存，然后尝试通过数组进行迭代以获取我想要的字节。我花了一些时间试图解决它，但真的很挣扎。 FYI，此方法读取指针，然后如果该值是指针，则读取该指针，依此类推，直到它到达静态地址，然后读取该地址处的字节值。

[DllImport("kernel32", EntryPoint = "ReadProcessMemory")]
private static extern byte ReadProcessMemoryByte(int Handle, int Address, ref byte Value, int Size, ref int BytesRead);


public static byte ReadPointerByte(string EXENAME, int Pointer, int[] Offset)
{
    byte Value = 0;
    checked
    {
        try
        {
            Process[] Proc = Process.GetProcessesByName(EXENAME);
            if (Proc.Length != 0)
            {
                int Bytes = 0;
                int Handle = OpenProcess(PROCESS_ALL_ACCESS, 0, Proc[0].Id);
                if (Handle != 0)
                {
                    foreach (int i in Offset)
                    {
                        ReadProcessMemoryInteger((int)Handle, Pointer, ref Pointer, 4, ref Bytes);
                        Pointer += i;
                    }
                    ReadProcessMemoryByte((int)Handle, Pointer, ref Value, 2, ref Bytes);
                    CloseHandle(Handle);
                }
            }
        }
        catch
        { }
    }
    return Value;
}

到目前为止我所拥有的：

 private void label1_Click(object sender, EventArgs e)
    {
        int[] valuesSeperated[200];
        List<byte> PreArray = new List<byte>();
        Process[] test = Process.GetProcessesByName("MyProcess"); //Get process handle 
        int baseAddress = test[0].MainModule.BaseAddress.ToInt32(); //Get base address
        byte ReadX  = MyClass.ReadPointerByte("MyProcess", BaseAddress, new int[] { 0xc, 0x0, 0x2 }); //call memory reading function (including memory offsets)
        PreArray.Add(ReadX);
                byte[] PreArrayToInt = PreArray.ToArray();
                int[] MYConvertedBytes = PreArray ToInt.Select(x => (int)x).ToArray();
                foreach (int i in MYConvertedBytes)
{
valuesSeperated // (don't really know what to do here, if the read was successful I would have a long number at [0], so now need to seperate these as if I had read each one in memory one at a time. 
}

string TestString = MYConvertedBytes[0].ToString();
                label1.Text = TestString;
    }

总结一下：我不知道如何使用上述方法读取更大的内存块（一次说200个地址）。我不知道如何最好地从结果数组中提取值，以形成一个现在已分隔字节的新数组。请问是否有什么不清楚，我很新，真的很想学习，所以任何提示/帮助都会非常感激。

Answer 1

你的互操作签名对我来说完全没错。

c签名是：

BOOL WINAPI ReadProcessMemory(
  __in   HANDLE hProcess,
  __in   LPCVOID lpBaseAddress,
  __out  LPVOID lpBuffer,
  __in   SIZE_T nSize,
  __out  SIZE_T *lpNumberOfBytesRead
);

应该是这样的：

[DllImport("kernel32", EntryPoint = "ReadProcessMemory",SetLastError=true)]
private static extern unsafe bool NativeReadProcessMemory(IntPtr processHandle, IntPtr baseAddress, byte* buffer, IntPtr size, out IntPtr bytesRead);

static unsafe void ReadProcessMemory(IntPtr processHandle, IntPtr baseAddress, byte[] buffer,int start, int size)
{
    fixed(byte* pBuffer=buffer)
    {
        IntPtr bytesRead;
        if(!NativeReadProcessMemory(processHandle, baseAddress, pBuffer+start,(IntPtr)size, out bytesRead))
           throw new Win32Exception(Marshal.GetLastWin32Error());
        if((int)bytesRead!=size)
            throw new Exception("Incomplete read");//User better exception type here
    }
}

读取内存块到数组？

1 个答案: