从注入的dll中搜索可执行文件内存中的字符串

时间:2015-02-19 02:26:00

标签: c++ windows

标题很好地解释了我的目标,它应该很简单,但我的解决方案似乎并没有正常运作。目前,该函数始终返回NULL。当我使用另一个程序来定位字符串并手动将memcmp指向它时,它会返回0。

DWORD findString(const char *input)
{
    DWORD address;
    size_t length = strlen(input);
    DWORD baseAddress = (DWORD)GetModuleHandle(NULL);
    DWORD maxAddress = (baseAddress + 26480640)-length;//the large # is the approximate size of the base module of the executable
    for (address = baseAddress; address < maxAddress; address++)
    {
        if (memcmp(input, (void *)address, length) == 0)
        {
            return address;
        }
    }
    OutputDebugStringA("String not found!");
    return NULL;
}

0 个答案:

没有答案