Question

我有这个程序在Windows 7中完美运行但在Windows 8上，当我输出它时，readprocessmemory似乎是空白的。获取上一个错误代码299.我没有为读取过程创建这部分程序但是我使用它因为它适用于Windows 7.游戏手柄和咏叹调位置在Windows 8机器上相同，我仔细检查了它们。并找到游戏句柄。该地址在Windows 7中正常工作。

hGameWindow = FindWindow(L"WFElementClient Window",NULL);
if(hGameWindow) {
    GetWindowThreadProcessId( hGameWindow, &dwProcId );         
    if( dwProcId != 0 ) {  
        hProcHandle = OpenProcess( PROCESS_ALL_ACCESS, FALSE, dwProcId ); 
        if( hProcHandle == INVALID_HANDLE_VALUE || hProcHandle == NULL ) { 
            GameStatus = "Failed to open process for valid handle"; 
        }else{
            GameStatus = "Game Found";
            myaddr = FindPointerAddr(hProcHandle, ariaBase, aOffset);
            // IsGameAvail = true;
        }
    } 
    else GameStatus = "Failed to obtain process id";
}
else GameStatus = "game handle not found";

ReadProcessMemory(hProcHandle, (LPCVOID)myaddr, &buffer, sizeof(buffer), NULL);

int FindPointerAddr(HANDLE pHandle,int baseaddr, DWORD offsets[])
{
    int Address = baseaddr;
    int offset = 0;
    int offsetCount = 5;
    for (int i = 0; i < offsetCount; i++) 
    {
        ReadProcessMemory(pHandle, (LPCVOID)Address, &Address , 4, NULL);
        Address+=offsets[i];
    }
    return Address;
}

Answer 1

安全权限已从Windows 7更改为Windows 8。

您可能需要以管理员身份运行并立即设置SeDebugPrivelage，而在以前的Windows版本中则不需要。例如使用PROCESS_ALL_ACCESS调用OpenProcess（）时，因为PROCESS_VM_READ需要SeDebugPrivelage

这是设置SeDebugPrivelage的方法：

bool SetDebugPrivilege(bool Enable)
{
    HANDLE hToken{ nullptr };
    if (!OpenProcessToken(GetCurrentProcess(), TOKEN_QUERY | TOKEN_ADJUST_PRIVILEGES, &hToken))
        return false;

    TOKEN_PRIVILEGES TokenPrivileges{};
    TokenPrivileges.PrivilegeCount = 1;
    TokenPrivileges.Privileges[0].Attributes = Enable ? SE_PRIVILEGE_ENABLED : 0;

    if (!LookupPrivilegeValueA(nullptr, "SeDebugPrivilege", &TokenPrivileges.Privileges[0].Luid))
    {
        CloseHandle(hToken);
        return false;
    }

    if (!AdjustTokenPrivileges(hToken, FALSE, &TokenPrivileges, sizeof(TOKEN_PRIVILEGES), nullptr, nullptr))
    {
        CloseHandle(hToken);
        return false;
    }

    CloseHandle(hToken);

    return true;
}

Windows 8上的ReadProcess Memory 299

1 个答案: