这个例子够完整了吧，直接就可以在2k中修改游戏了
Unit1.pas
unit Unit1;
interface
uses
Windows, Messages, SysUtils, Classes, Controls, Forms, Dialogs,
StdCtrls, ComCtrls, ExtCtrls, Buttons, TLHelp32, psapi, Menus;
type
TForm1 = class(TForm)
GroupBox1: TGroupBox;
Button2: TButton;
Memo1: TMemo;
Edit4: TEdit;
Edit5: TEdit;
Xg_00: TEdit;
Zj_00: TComboBox;
Button3: TButton;
PopupMenu1: TPopupMenu;
N1: TMenuItem;
N2: TMenuItem;
N3: TMenuItem;
ListView1: TListView;
N4: TMenuItem;
CheckBox1: TCheckBox;
CheckBox2: TCheckBox;
CheckBox3: TCheckBox;
CheckBox4: TCheckBox;
Edit1: TEdit;
Edit2: TEdit;
Label1: TLabel;
Edit3: TEdit;
procedure Button3Click(Sender: TObject);
procedure N1Click(Sender: TObject);
procedure FormCreate(Sender: TObject);
procedure ListView1ColumnClick(Sender: TObject; Column: TListColumn);
procedure N4Click(Sender: TObject);
private
{ Private declarations }
procedure MEM_ProcessColumn(V: Integer);
public
BeingDebugged: boolean;
{ Public declarations }
end;
var
Form1: TForm1;
function get_proc_name(pid: DWORD): string;
implementation
{$R *.DFM}
function get_proc_name(pid: DWORD): string;
// nt/2000版本的函数：
function get_proc_name_nt(pid: DWORD): string;
var
hp, hmod, need: DWORD;
name: array[0..MAX_PATH] of char;
begin
hp := OpenProcess(PROCESS_VM_READ or PROCESS_QUERY_INFORMATION, false, pid);
if hp = 0 then
RaiseLastWin32Error;
EnumProcessModules(hp, @hmod, 4, need);
GetModuleFileNameEx(hp, hmod, name, MAX_PATH);
CloseHandle(hp);
Result := name;
end;
//win9x版本的函数：
function get_proc_name_9x(pid: DWORD): string;
var
snapshot: DWORD;
pe: TProcessEntry32;
begin
snapshot := CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
if integer(snapshot) = -1 then
RaiseLastWin32Error();
Result := '未知';
pe.dwSize := sizeof(pe);
if Process32First(snapshot, pe) then
repeat
if pe.th32ProcessID = pid then
begin
Result := pe.szExeFile;
break;
end;
until not Process32Next(snapshot, pe);
CloseHandle(snapshot);
end;
begin
if Win32Platform = VER_PLATFORM_WIN32_NT then
Result := get_proc_name_nt(pid)
else
Result := get_proc_name_9x(pid);
end;
procedure TForm1.Button3Click(Sender: TObject);
var
ProcessHndle, FSnapshotHandle: THandle;
FProcessEntry32: TProcessEntry32;
Ret: BOOL;
Buffer, i, MemDz, ProcessID: integer;
lpBuffer: pByte;
lpNumberOfBytesRead, nSize, hwnd_s: dword;
s: string;
begin
ProcessID := -1;
if CheckBox2.Checked then
getwindowthreadprocessid(StrToIntDef(Edit1.Text, 0), @ProcessID)
else if CheckBox3.Checked then
ProcessID := StrToIntDef(Edit5.Text, 0)
else if CheckBox1.Checked then
begin
hwnd_s := findwindowexa(0, 0, 0, pchar(Edit2.Text));
if hwnd_s > 0 then
getwindowthreadprocessid(hwnd_s, @ProcessID);
if CheckBox4.Checked then
if pos(Edit4.Text, get_proc_name(ProcessID)) = 0 then
ProcessID := -1;
end
else if CheckBox4.Checked then
begin
FSnapshotHandle := CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
FProcessEntry32.dwSize := Sizeof(FProcessEntry32);
Ret := Process32First(FSnapshotHandle, FProcessEntry32);
while Ret do
begin
s := ExtractFileName(FProcessEntry32.szExeFile);
if s = ExtractFileName(Edit4.Text) then
begin
ProcessID := FProcessEntry32.th32ProcessID;
break;
end;
Ret := Process32Next(FSnapshotHandle, FProcessEntry32);
end;
s := '';
CloseHandle(FSnapshotHandle);
end;
if ProcessID = -1 then
begin
Memo1.Text := '目标程序没找到';
exit;
end;
Memo1.Lines.Clear;
memo1.lines.add('Process ID $' + IntToHex(ProcessID, 8) + ' (' + format('%.8d',
[ProcessID]) + ')');
memo1.lines.Add('File Name ' + get_proc_name(ProcessID));
nSize := Zj_00.ItemIndex + 1;
lpBuffer := AllocMem(nSize);
ProcessHndle := OpenProcess(generic_read or generic_write, false, ProcessID);
memo1.Lines.Add('Process Handle ' + intTohex(ProcessHndle, 8));
if (Edit3.Text <> '') and
(Edit3.Text[1] = 'h') or
(Edit3.Text[1] = 'H') then
MemDz := StrToIntDef('$' + copy(Edit3.Text, 2, Length(Edit3.Text)), 0)
else
MemDz := StrToIntDef(Edit3.Text, 0);
memo1.Lines.Add('查看地址 ' + intTohex(MemDz, 8) + 'h');
Buffer := StrToIntDef(Xg_00.Text, 0);
if Sender = Button3 then
WriteProcessMemory(ProcessHndle, Pointer(MemDz), @Buffer, sizeof(Buffer),
lpNumberOfBytesRead);
MemDz := (MemDz div 16) * 16;
s := intTohex(MemDz, 8) + 'h:';
for i := MemDz to MemDz + 16 * 8 do
begin
ReadProcessMemory(ProcessHndle, Pointer(i), lpBuffer, nSize,
lpNumberOfBytesRead);
s := s + intTohex(lpBuffer^, 2) + ' ';
//读取内容
if (i mod 16) = 15 then
begin
Memo1.Lines.Add(s);
s := intTohex(i + 1, 8) + 'h:';
end;
//格式化输出
end;
FreeMem(lpBuffer, nSize);
CloseHandle(ProcessHndle);
//关闭句柄，释放内存
end;
procedure TForm1.N1Click(Sender: TObject);
var
hCurrentWindow: HWnd;
szText: array[0..254] of char;
NewItem: TListItem;
id: dword;
begin
ListView1.Items.Clear;
hCurrentWindow := GetWindow(Handle, GW_HWNDFIRST);
while hCurrentWindow <> 0 do
begin
if GetWindowText(hCurrentWindow, @szText, 255) > 0 then
if N3.Checked or IsWindowVisible(hCurrentWindow) then //得到窗口是否visible
begin
NewItem := ListView1.Items.add;
NewItem.Caption := strpas(szText);
NewItem.subItems.Add(format('%.8d', [hCurrentWindow]));
getwindowthreadprocessid(hCurrentWindow, @id); //得到窗口的线程id
NewItem.subItems.Add(format('%.8d', [ID]));
NewItem.subItems.Add(get_proc_name(id));
end;
hCurrentWindow := GetWindow(hCurrentWindow, GW_HWNDNEXT);
end;
end;
procedure TForm1.FormCreate(Sender: TObject);
begin
N1Click(nil);
end;
procedure TForm1.MEM_ProcessColumn(V: Integer);
function CustomSortProc(Item1, Item2: TListItem; lParam: LongInt): Integer;
stdcall;
begin
if (lParam >= 0) then
begin
if abs(Form1.ListView1.Tag) = 1 then
result := Form1.ListView1.Tag * CompareText(Item1.Caption, Item2.Caption)
else
result := Form1.ListView1.Tag *
CompareText(Item1.SubItems.Strings[abs(Form1.ListView1.Tag) - 2],
Item2.SubItems.Strings[abs(Form1.ListView1.Tag) - 2]);
end
else
result := 0;
end;
begin
N1Click(nil);
inc(v);
if ListView1.Tag = V then
ListView1.Tag := -V
else
ListView1.Tag := V;
ListView1.CustomSort(@CustomSortProc, 0);
end;
procedure TForm1.ListView1ColumnClick(Sender: TObject;
Column: TListColumn);
begin
MEM_ProcessColumn(Column.Index);
end;
procedure TForm1.N4Click(Sender: TObject);
begin
if ListView1.ItemIndex > -1 then
begin
Edit2.Text := ListView1.Items.Item[ListView1.ItemIndex].Caption;
Edit1.Text := ListView1.Items.Item[ListView1.ItemIndex].SubItems[0];
Edit5.Text := ListView1.Items.Item[ListView1.ItemIndex].SubItems[1];
Edit4.Text := ListView1.Items.Item[ListView1.ItemIndex].SubItems[2];
end;
end;
end.
