Question

我想读取记事本的整个内存，并将输出写入文本文件。如果我在记事本中键入内容，我找不到输入中输入的内容。这是代码：

HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, entry.th32ProcessID);
char* ptr = 0;
MEMORY_BASIC_INFORMATION info;
while(ptr<=(char*)0x7FFF0000)
{
    VirtualQueryEx(hProcess,(LPCVOID)ptr,&info,sizeof(info));
    if((info.AllocationProtect==0x04) || (info.AllocationProtect==0x10) || 
       (info.AllocationProtect==0x20) || (info.AllocationProtect==0x40) || 
       (info.AllocationProtect==0x80) || (info.AllocationProtect==0x02) || 
       (info.AllocationProtect==0x08))
    {
        int bytes_to_read = (int)info.RegionSize;
        char *buffer = NULL;
        buffer = (char *)malloc(info.RegionSize);
        ReadProcessMemory(hProcess,
                          info.BaseAddress,
                          &buffer,
                          bytes_to_read,
                          NULL);
        ofstream out;
        out.open("test.txt",ios_base::app);
        out << buffer;
        out.close();
    }
    ptr += info.RegionSize;
}

Answer 1

你不能写那样的缓冲区。 C ++假定它包含一个以0结尾的字符串。

尝试

out.write(buffer, bytes_to_read);

同时使用标志

打开文件

ios::binary | ios::out

从记事本进程内存中读取文本

1 个答案: