高手请教读出内存的内容(50分)

  • 主题发起人 主题发起人 江上游者
  • 开始时间 开始时间

江上游者

Unregistered / Unconfirmed
GUEST, unregistred user!
原代码;
procedure TForm1.Button2Click(Sender: TObject);
var
hwnd:cardinal;
pid:Dword;
hProcess:cardinal;
x:string;
Num: cardinal;

i:integer;
s:string;

lpBuffer:pByte;
nSize: DWORD;
lpNumberOfBytesRead: DWORD;
begin
setlength(X,$10);
setlength(X1,$100);
hwnd := FindWindow(nil,'程序名');
if hwnd = 0 then
Exit;
GetWindowThreadProcessId (hwnd, @pid);
hProcess := OpenProcess(PROCESS_ALL_ACCESS, false, pid);

nSize:=$4;
lpBuffer:=AllocMem(nSize);

If hProcess <> 0 Then
begin
if not ReadProcessMemory(hprocess,Pointer($1015334),@x,$12,num) then
begin
label1.Caption := string(@x); //

for i:=$00800001 to $00800020 do
begin
ReadProcessMemory(
hprocess,
Pointer(i),
lpBuffer,
nSize,
num
);
s:=s+intTohex(lpBuffer^,2)+' ';

//读取内容
if (i mod 16) =0 then
begin
Memo1.Lines.Add(s); //
s:=' ';
end;
//格式化输出
end
end
else //2
showmessage('读数失败...!');
end
else //1
showmessage('未启动程序');
CloseHandle(hProcess);
end;

问题:
使用ReadProcessMemory:
1)在ReadProcessMemory(hprocess,Pointer($1015334),@x,$12,num)中,怎么修改Pointer($1015334)中的$1015334数字,label1.Caption := string(@x)的结果都是同一个字.
2)在for i:=$00800001 to $00800020 do
begin
ReadProcessMemory(
hprocess,
Pointer(i),
lpBuffer,
nSize,
num
);
s:=s+intTohex(lpBuffer^,2)+' ';
//读取内容
if (i mod 16) =0 then
begin
Memo1.Lines.Add(s); //
s:=' ';
end;
中,如何修改Pointer(i)中的i值,读出的值是地址值,不能搜索内存内容.
 
想做内挂,哈哈
 
to jxzqsun
你会么不会?
 
高手在请教,教上教,先教而后叫....
 
没有人解答此问题
 
Cheat Engine专业的破解工具,兄弟值得你研究.
讯雷上原代码下载....
 
CE貌似对很多游戏无法读了 CE的代码外挂海上就有
 
1)在ReadProcessMemory(hprocess,Pointer($1015334),@x,$12,num)中,怎么修改Pointer($1015334)中的$1015334数字,label1.Caption := string(@x)的结果都是同一个字.

label1.Caption:=X 就是你要读出的字符
 
1)在ReadProcessMemory(hprocess,Pointer($1015334),@x,$12,num)中, 怎么修改Pointer($1015334)中的我将$1015334换成$1015335,$1015336,$1015337.....数字,label1.Caption := string(@x)的结果都是同一个字.

不知道那里出现错误
 
function getexeMem(ProcessID: integer; fn: string; size: Longint): boolean;


function getexeMem(ProcessID: integer; fn: string; size: Longint): boolean;
var
FSnapshotHandle: THandle;
FProcessEntry32: TProcessEntry32;
Ret: BOOL;
ProcessHndle: THandle;
pmc: PPROCESS_MEMORY_COUNTERS;
cb: Integer;
WorkingSetSize: DWORD;

i, k: integer;
lpBuffer: pbyte;
nSize: DWORD;
lpNumberOfBytesRead: DWORD;
p: pchar;
p0: pchar;
fs: TFileStream;
begin
Result := False;

ProcessHndle := OpenProcess(PROCESS_VM_READ, false, ProcessID);
cb := sizeof(_PROCESS_MEMORY_COUNTERS);
GetMem(pmc, cb);
pmc^.cb := cb;
if GetProcessMemoryInfo(ProcessHndle, pmc, cb) then
begin
WorkingSetSize := pmc^.WorkingSetSize;
end
else
WorkingSetSize := 0;
FreeMem(pmc);

nSize := 512;
lpBuffer := AllocMem(nSize);
p0 := AllocMem(nSize);
FillChar(p0[0], nSize, 0);
i := $000000;
fs := TFileStream.Create(fn, fmCreate);
while i < size {WorkingSetSize } do
begin
if ReadProcessMemory(
ProcessHndle,
Pointer(i),
lpBuffer,
nSize,
lpNumberOfBytesRead
) then
begin
p := PChar(lpBuffer);
fs.WriteBuffer(p[0], nSize);
end
else
begin
fs.WriteBuffer(p0[0], nSize);
end;
i := i + nSize;
end;
FreeAndNil(fs);
CloseHandle(ProcessHndle); //关闭句柄,释放内存}
FreeMem(lpBuffer, nSize);
end;
 
在<>括号在为Undeclared iedntifier
pmc: <PPROCESS_MEMORY_COUNTERS>;
cb := sizeof(<_PROCESS_MEMORY_COUNTERS>);
pmc^.<c>b := cb;
if <GetProcessMemoryInfo>(ProcessHndle, pmc, cb) then
WorkingSetSize := pmc^.<WorkingSetSize>;
 

Similar threads

S
回复
0
查看
3K
SUNSTONE的Delphi笔记
S
S
回复
0
查看
2K
SUNSTONE的Delphi笔记
S
后退
顶部