怎样在当前进程的内存中查找指定字符串？ ( 积分: 100 )

S

shawy

Unregistered / Unconfirmed

GUEST, unregistred user!

• 2005-05-14

• #1

如果有多个相同字符串的话返回第一个就行

 

S

shawy

Unregistered / Unconfirmed

GUEST, unregistred user!

• 2005-05-14

• #2

如果有多个相同字符串的话返回第一个就行

 

D

dawnsong

Unregistered / Unconfirmed

GUEST, unregistred user!

• 2005-05-14

• #3

http://www.delphibbs.com/delphibbs/dispq.asp?lid=3062590

 

S

shawy

Unregistered / Unconfirmed

GUEST, unregistred user!

• 2005-05-14

• #4

我已经用ReadProcessMemory(GetCurrentProcess,Pointer(I),lpBuffer,nSize,lpNumberOfBytesRead)查得字符串范围在$0042BF38-&gt;$0042BFBA<br>怎样把这段内存修改为其他字符串?

 

D

dawnsong

Unregistered / Unconfirmed

GUEST, unregistred user!

• 2005-05-14

• #5

WriteProcessMemory(ProcessHandle,Pointer($0042BF38),buf,$0042BFBA-$0042BF38,BytesWorked);

 

S

shawy

Unregistered / Unconfirmed

GUEST, unregistred user!

• 2005-05-14

• #6

我试过了，在同一进程内改的（dll注入主程序，在dll内改的），提示说：<br>ERROR_NOACCESS<br>998 Invalid access to memory location.

 

S

shawy

Unregistered / Unconfirmed

GUEST, unregistred user!

• 2005-05-14

• #7

用copymemeory也不行,会出现access violation错误（当前进程）<br>Procedure ModifyMemory;<br>var<br>ptointer;<br>pStrCHAR;<br>BytesWritten,j:cardinal;<br>begin<br> &nbsp;longword(pt):=$0042BF38;<br> &nbsp;pStr:='My New String';<br> &nbsp;try<br> &nbsp; &nbsp;CopyMemory(pt,pStr,strlen(pStr));<br> &nbsp;except<br> &nbsp; &nbsp;on E:Exception do<br> &nbsp; &nbsp;showmsg(e.Message);<br> &nbsp;end;<br>end;

 

L

lichengbin

Unregistered / Unconfirmed

GUEST, unregistred user!

• 2005-05-14

• #8

用VirtualProtectEx更改页属性为PAGE_READWRITE

 

刘

刘麻子

Unregistered / Unconfirmed

GUEST, unregistred user!

• 2005-05-14

• #9

http://www.2ccc.com/article.asp?articleid=992

 

S

shawy

Unregistered / Unconfirmed

GUEST, unregistred user!

• 2005-05-15

• #10

接受答案了