我在另一个StackOverflow问题中找到了以下代码:
#include <iostream>
#include <vector>
#include <string>
#include <windows.h>
#include <algorithm>
#include <iterator>
template <class outIter>
void find_locs(HANDLE process, std::string const &pattern, outIter output) {
unsigned char *p = NULL;
MEMORY_BASIC_INFORMATION info;
for ( p = NULL;
VirtualQueryEx(process, p, &info, sizeof(info)) == sizeof(info);
p += info.RegionSize )
{
std::vector<char> buffer;
std::vector<char>::iterator pos;
if (info.State == MEM_COMMIT &&
(info.Type == MEM_MAPPED || info.Type == MEM_PRIVATE))
{
DWORD bytes_read;
buffer.resize(info.RegionSize);
ReadProcessMemory(process, p, &buffer[0], info.RegionSize, &bytes_read);
buffer.resize(bytes_read);
for ( pos = buffer.begin();
buffer.end()!=(pos=std::search(pos, buffer.end(), pattern.begin(), pattern.end()));
++pos)
{
*output++ = p+(pos-buffer.begin());
}
}
}
}
int main(int argc, char **argv) {
if (argc != 3) {
fprintf(stderr, "Usage: %s <process ID> <pattern>", argv[0]);
return 1;
}
int pid;
sscanf(argv[1], "%i", &pid);
std::string pattern(argv[2]);
HANDLE process = OpenProcess(
PROCESS_VM_READ | PROCESS_QUERY_INFORMATION,
false,
pid);
find_locs(process, pattern,
std::ostream_iterator<void *>(std::cout, "\n"));
return 0;
}
但这是为了搜索字节。我想在内存中搜索一个特定的字符串,使用它我可以读取与之关联的值,然后在满足某个条件时修改它。比如,explorer.exe内存中的字符串MakeAllAppsDefault存储值0x00000000或0x00000001(取决于注册表中MakeAllAppsDefault的值),我想更改它。