我的问题：如何修改WIN98或是2000的内存（100分）(100分)

各位大侠：小弟有一问题，本人想修改WIN98或是WIN2000的内存，一般情况下先要得到该<br>程序窗口的HANDEL，但不知道如何修改该程序的内存，大侠们帮帮忙吧，谢了

试试改注册表

改注册表吗？<br>我所需要的是动态的修改呀！就象是FPE或是其他内存修改工具一样的方法（当然我知道FP<br>E在2000下是不能用的，2000好象有内存的保护？）

好像应该要得到 Ring0 级的优先权。

高手们高手们在哪？？？！！！help me.....

让我来告诉你怎么做：<br>首先，你要明白几个前提：<br>1：修改内存只是针对某个进程而言，你只能修改某个进程的内存，这里所有的内存只是指<br>虚拟内存<br>2：某些系统进程的内存无法修改<br>3：某个进程内的内存只能是部分修改，而不能全部修改。<br>明白以上前提后，就好说了，首先你要能够取得系统的调试特权，取到后，你通过枚举<br>系统进程的方法得到你要操作的进程的id，然后用OpenProcess函数打开他，得到它的<br>句柄，最后你可以用ReadProcessMemory读取次进程的内存，用WriteProcessMemory修改<br>次进程的内存，具体函数的用法你可以参照msdn，内有很详细的介绍！！！<br>我自己写过一个工具是nt版的！

To StrayBear:<br><br>&nbsp; &nbsp;您所说的这种方法我试过了，你能用BCB4。0写一个写NT2000的范例程序给我吗？<br>&nbsp; &nbsp;我查过很多资料，NT2000的内存要写不是太容易，不知道是不是这样的！<br>&nbsp; &nbsp;mail to :microboys@163.net<br>&nbsp; &nbsp;给我例子我再给你一百分，谢了

给我一份好吗?

你要写内存的话，是受到很大的限制的（如只能是一段内存区域,区域你可以通过查找的办法<br>得到，当然查找时第增量为0x1000，就可以的拉），但肯定可以写，不过这段时间在赶一个项目，写<br>2000下的程序是时间了的了！！！如果nt下的你要的话，可以给你一份！！！

这是我写的一个内存修改程序的某段（是个cracker内存补丁)，相信对你会有帮助<br><br>procedure TForm1.Button1Click(Sender: TObject);<br>var<br>&nbsp; FSnapshotHandle:THandle;<br>&nbsp; FProcessEntry32:TProcessEntry32;<br>&nbsp; Ret : BOOL;<br>&nbsp; ProcessID : integer;<br>&nbsp; ProcessHndle : THandle;<br>&nbsp; lpBufferbyte;<br>&nbsp; nSize: DWORD;<br>&nbsp; lpNumberOfBytesWrite: DWORD;<br>&nbsp; i:integer;<br>&nbsp; s:string;<br>begin<br>&nbsp; FSnapshotHandle:=CreateToolhelp32Snapshot(<br>TH32CS_SNAPPROCESS,0);<br>&nbsp; &nbsp; //创建系统快照<br>&nbsp; FProcessEntry32.dwSize:=Sizeof(FProcessEntry32);<br>&nbsp; &nbsp; //先初始化 FProcessEntry32 的大小<br>&nbsp; Ret:=Process32First(FSnapshotHandle,FProcessEntry32);<br>&nbsp; while Ret do<br>&nbsp; begin<br>&nbsp; &nbsp; s:=ExtractFileName(FProcessEntry32.szExeFile);<br>&nbsp; &nbsp; if s='xxxx.EXE' then &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;//你要修改的exe文件名<br>&nbsp; &nbsp; begin<br>&nbsp; &nbsp; &nbsp; ProcessID:=FProcessEntry32.th32ProcessID;<br>&nbsp; &nbsp; &nbsp; s:='';<br>&nbsp; &nbsp; &nbsp; break;<br>&nbsp; &nbsp; end;<br>&nbsp; &nbsp; Ret:=Process32Next(FSnapshotHandle,FProcessEntry32);<br>&nbsp; end;<br>&nbsp; &nbsp;//循环枚举出系统开启的所有进程，找出“G:/xxx/xxx.exe”<br>&nbsp; CloseHandle(FSnapshotHandle);<br>&nbsp; //Memo1.Lines.Clear ;<br>&nbsp; //memo1.lines.add('Process ID '+IntToHex(FProcessEntry32.th32ProcessID));<br>&nbsp; //memo1.lines.Add('File name '+FProcessEntry32.szExeFile);<br>&nbsp; &nbsp; ////输出进程的一些信息<br>&nbsp; nSize:=2;<br>&nbsp; lpBuffer:=AllocMem(nSize);<br>&nbsp; ProcessHndle:=OpenProcess(PROCESS_VM_WRITE,false,ProcessID);<br>//现在可以开始修改了。i是内存偏移地址，lpbuffer是要修改的数值<br>&nbsp; i:=$00451ebd;<br>&nbsp; lpbuffer^:=$84;<br>&nbsp; WriteProcessMemory(<br>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;ProcessHndle,<br>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Pointer(i),<br>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;lpBuffer,<br>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;nSize,<br>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;lpNumberOfBytesWRite<br>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;<br>//下面是读内存的方法<br>&nbsp; ReadProcessMemory(<br>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;ProcessHndle,<br>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Pointer(i),<br>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;lpBuffer,<br>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;nSize,<br>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;lpNumberOfBytesWRite<br>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;<br>&nbsp; edit1.text:=inttohex(i)+' value Is:'+intTohex(lpBuffer^);<br>&nbsp; FreeMem(lpBuffer,nSize);<br>&nbsp; CloseHandle(ProcessHndle);<br>&nbsp; application.Terminate;<br>&nbsp; &nbsp;//关闭句柄，释放内存<br>end;<br><br>记得把 TLHelp32加入到use,单这个单元只能在win9x下，nt下不能用的。<br><br><br>

听听

&gt;&gt;

OK，我先试试，先给你100分

to bluely:<br>ProcessID 没有初始化？？<br>

xzxzxzxz

请问<br>//现在可以开始修改了。i是内存偏移地址，lpbuffer是要修改的数值<br>&nbsp;i:=$00451ebd;<br>这个地址偏移地址是如何的到的,

关注如何得到这个内存的偏移地址?