搜索内存数据(-)
2014年02月04日
⁄ 综合
⁄ 共 3563字 ⁄ 字号
小 中 大
- Private Type MEMORY_BASIC_INFORMATION
- BaseAddress As Long
- AllocationBase As Long
- AllocationProtect As Long
- RegionSize As Long
- State As Long
- Protect As Long
- lType As Long
- End Type
- Private Declare Function OpenProcess Lib "kernel32" (ByVal dwDesiredAccess As Long, ByVal bInheritHandle As Long, ByVal dwProcessId As Long) As Long
- Private Declare Function CloseHandle Lib "kernel32" (ByVal hObject As Long) As Long
- Private Declare Sub api_CopyMemory Lib "kernel32" Alias "RtlMoveMemory" (Destination As Any, Source As Any, ByVal Length As Long)
- Private Declare Function WriteProcessMemory Lib "kernel32" (ByVal hProcess As Long, lpBaseAddress As Any, lpBuffer As Any, ByVal nSize As Long, lpNumberOfBytesWritten As Long) As Long
- Private Declare Function ReadProcessMemory Lib "kernel32" (ByVal hProcess As Long, lpBaseAddress As Any, lpBuffer As Any, ByVal nSize As Long, lpNumberOfBytesWritten As Long) As Long
- Private Declare Function GetModuleHandle Lib "kernel32" Alias "GetModuleHandleA" (ByVal lpModuleName As String) As Long
- Private Declare Function VirtualProtectEx Lib "kernel32" (ByVal hProcess As Long, lpAddress As Any, ByVal dwSize As Long, ByVal flNewProtect As Long, lpflOldProtect As Long) As Long
- Private Declare Function VirtualQueryEx Lib "kernel32" (ByVal hProcess As Long, ByVal lpAddress As Long, lpBuffer As MEMORY_BASIC_INFORMATION, ByVal dwLength As Long) As Long
- Private Declare Function CreateRemoteThread Lib "kernel32" (ByVal hProcess As Long, ByVal lpThreadAttributes As Long, ByVal dwStackSize As Long, ByVal lpStartAddress As Long, ByVal lpParameter As Long, ByVal dwCreationFlags As Long, lpThreadId As Long) As Long
- Private Declare Function WaitForSingleObject Lib "kernel32" (ByVal hHandle As Long, ByVal dwMilliseconds As Long) As Long
- Private Const PROCESS_ALL_ACCESS =
- Private Const PAGE_READWRITE =
- Private Const MEM_COMMIT =
- Private Const ERR_MEMRW = 40010
- Private c_MemStop As Boolean
- Private c_PID As Long
- Private Function Mem_SearchBytArray(bytData() As Byte, ListAddress() As Long, Optional lpStart As Long = &H400000, Optional lpEnd As Long = &H7FFFFFFF) As Long
- Dim nCount As Long
- Dim bfSize As Long
- Dim mbSize As Long
- Dim mbloop As Long
- Dim bfloop As Long
- Dim ret As Long
- Dim lpAddress As Long
- Dim hProcess As Long
- Dim MBI As MEMORY_BASIC_INFORMATION
- Dim lpBuffer() As Byte
- c_MemStop = False
- mbSize = Len(MBI)
- bfSize = UBound(bytData)
- lpAddress = lpStart
- hProcess = OpenProcess(PROCESS_ALL_ACCESS, False, c_PID)
- ret = VirtualQueryEx(hProcess, lpAddress, MBI, mbSize)
- Do While (ret And (lpAddress < lpEnd) And Not c_MemStop)
- If (MBI.Protect And PAGE_READWRITE) And (MBI.State = MEM_COMMIT) Then
- ReDim lpBuffer(MBI.RegionSize - 1)
- ReadProcessMemory hProcess, ByVal MBI.BaseAddress, lpBuffer(0), MBI.RegionSize, 0
- For mbloop = 0 To MBI.RegionSize - 1 - bfSize
- For bfloop = 0 To bfSize
- If bytData(bfloop) <> lpBuffer(mbloop + bfloop) Then GoTo runSearchNext
- Next
- ReDim Preserve ListAddress(nCount) As Long
- ListAddress(nCount) = mbloop + MBI.BaseAddress
- nCount = nCount + 1
- runSearchNext:
- Next
- End If
- lpAddress = lpAddress + MBI.RegionSize
- ret = VirtualQueryEx(hProcess, lpAddress, MBI, mbSize)
- Loop
- Mem_SearchBytArray = nCount
- Call CloseHandle(hProcess)
- End Function