使用ReadProcessMemory（）

Question

编辑：解决了我的问题..我一直在使用错误的地址......

如何使用C ++中的函数ReadProcessMemory从进程中读取未知大小的字符串或字符数组？

我尝试了什么：

    std::string temp;
    ReadProcessMemory(*hProcess, (LPCVOID)(address+offset), &temp, sizeof(temp), &bytesRead);               
    mywString = string2wstring(temp);

函数string2wstring（）： Source of function

std::wstring string2wstring(const std::string& str)
{
    int size_needed = MultiByteToWideChar(CP_UTF8, 0, &str[0], (int)str.size(), NULL, 0);
    std::wstring wstrTo(size_needed, 0);
    MultiByteToWideChar(CP_UTF8, 0, &str[0], (int)str.size(), &wstrTo[0], size_needed);
    return wstrTo;
}

我能够成功读取字符串，但是当我运行它时，我一直收到读取访问冲突：

#include <iostream>
#include <windows.h>
#include <string>


void main()
{
    HANDLE hProcess;
    DWORD pID = 000;
    SIZE_T bytesRead;
    uintptr_t address = 0x000;

    //HWND gameWindow = FindWindow(NULL, L"TEXTCHECK");
    //GetWindowThreadProcessId(gameWindow, &pID);

    hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, pID);


    std::string temp;
    if (ReadProcessMemory(hProcess, (LPCVOID)(address), &temp, sizeof(temp), &bytesRead))
    {
    }

    std::cout << temp;

    system("pause");

}

测试：

#include <iostream>
#include <string>
#include <Windows.h>
#include <stdlib.h>

using namespace std;

int main() {

    int varInt = 123456;
    string varString = "DefaultString";
    const char arrChar[128] = "Long char array AABBCCDDEEFFGGHHIIJJKKLL"; 
    int* ptr2int = &varInt;
    int** ptr2ptr = &ptr2int;
    int*** ptr2ptr2 = &ptr2ptr;



    while (1) {
        cout << "Process ID: " << GetCurrentProcessId() << "\n";
        cout << "\n";
        cout << "varInt     (0x" << &varInt << ") = " << varInt << "\n";
        cout << "varString  (0x" << &varString << ") = " << varString << "\n";
        cout << "arrChar    (0x" << &arrChar << ") = " << arrChar << "\n";
        cout <<"\n";
        cout << "ptr2int    (0x" << &ptr2int << ") = 0x" << ptr2int << "\n";
        cout << "ptr2ptr    (0x" << &ptr2ptr << ") = 0x" << ptr2ptr << "\n";
        cout << "ptr2ptr2   (0x" << &ptr2ptr2 << ") = 0x" << ptr2ptr2 << "\n";

        cout << "\n";
        cout << "Press ENTER to print again.";
        cout << "\n";
        cout << flush;
        cin.get();
        cout << "----------------------------------------\n\n\n";
        //system("CLS");

    }
    return 0;
}

  GETSTRINGFROMMEM.EXE [16984]

发生了

托管的win32异常

Answer 1

您必须知道要阅读的确切尺寸。如果您不知道尺寸，您唯一的希望是：

• 字符串数据的前缀是您可以阅读的

• 字符串数据以空值终止，在这种情况下，您必须一次读取1个字符，直到找到空终止符。