用WriteProcessMemory和指針在另一個進程的內存中寫入

Question

可能有幾個帖子以幾種方式解釋我的問題......但我一直在谷歌和stackoverflow搜索框中搜索，但我沒有找到任何東西。所以，我走了。

我想在一個進程內存寫的字符串，在C++中更改，但我甚至不很清楚地知道它是如何工作，所以..

我有這個指針： Image of the pointer 請，有人可以幫我在做什麼？

我已經試過了，但它不工作..

#include <windows.h> 
#include <iostream> 

int main() { 
    HWND hWnd = FindWindow(0, "WindowName"); 
    if (hWnd == 0) { 
     std::cout << "Cannot find window." << std::endl; 
    } 
    DWORD pId; 
    GetWindowThreadProcessId(hWnd, &pId); 
    HANDLE hProc = OpenProcess(PROCESS_ALL_ACCESS, FALSE, pId); 
    DWORD baseAddress = 0x009B03D0; 
    DWORD offset = 0xA7; 
    DWORD ptrAddress; 
    char *newString = "newvalue"; 
    ReadProcessMemory(hProc, (void*)baseAddress, &ptrAddress, sizeof(DWORD), 0); 
    WriteProcessMemory(hProc, (void*)(ptrAddress + offset), newString, strlen(newString), 0); 
    std::cout << "Done. " << &ptrAddress << std::endl; 
    std::getchar(); 
} 

我應該得到的指針和jumpt到最後一個，因爲我只有一個偏移。但我沒有得到正確的..

---

編輯：

這裏是我的新的代碼，它的工作原理，直到WriteProcessMemory的功能。什麼可能是錯誤的？

CODE的實際工作：

int main() 
{ 
    unsigned long Pointer; /* to hold the final value */ 
    unsigned long temp;  /* hold the temp values */ 
    unsigned long address = 0x009B03D0; 
    unsigned long offset = 0xA7; 
    unsigned long newString = 0; 
    DWORD pid; 
    HWND hwnd; 
    hwnd = FindWindow(0, TEXT("NewWindow")); 
    if (!hwnd) 
    { 
     cout << "No!\n"; 
     cin.get(); 
    } 
    else 
    { 
     GetWindowThreadProcessId(hwnd, &pid); 
     HANDLE phandle = OpenProcess(PROCESS_ALL_ACCESS, 0, pid); 
     if (!phandle) 
     { 
      cout << "None!\n"; 
      cin.get(); 
     } 
     else 
     { 
      while (1) 
      { 

       ReadProcessMemory(phandle, reinterpret_cast<LPVOID>(address), &temp, sizeof(temp), 0); 
       Pointer = temp + offset; 
       //Good 
       ReadProcessMemory(phandle, reinterpret_cast<LPVOID>(Pointer), &newString, 16, 0); 
       cout << reinterpret_cast<LPVOID>(Pointer) << " en " << newString; 
       Sleep(1000); 
      } 
      return 0; 
     } 
    } 
} 

CODE不是工作：

int main() 
{ 
    unsigned int Pointer; /* to hold the final value */ 
    unsigned int temp;  /* hold the temp values */ 
    unsigned int address = 0x009B03D0; 
    unsigned int offset = 0xA7; 
    unsigned int newString = 1768060259; 
    DWORD pid; 
    HWND hwnd; 
    hwnd = FindWindow(0, TEXT("NewWindow")); 
    if (!hwnd) 
    { 
     cout << "NO\n"; 
     cin.get(); 
    } 
    else 
    { 
     GetWindowThreadProcessId(hwnd, &pid); 
     HANDLE phandle = OpenProcess(PROCESS_ALL_ACCESS, 0, pid); 
     if (!phandle) 
     { 
      cout << "NONE\n"; 
      cin.get(); 
     } 
     else 
     { 
      while (1) 
      { 

       ReadProcessMemory(phandle, reinterpret_cast<LPVOID>(address), &temp, sizeof(temp), 0); 
       Pointer = temp + offset; 
       //Good 
       if (!WriteProcessMemory(phandle, reinterpret_cast<LPVOID>(Pointer), &newString, sizeof(newString), 0)) 
        std::cerr << "Couldn't write process memory:" << GetLastError() << std::endl; 
       cout << reinterpret_cast<LPVOID>(Pointer) << " en " << newString; 
       Sleep(1000); 
      } 
      return 0; 
     } 
    } 
} 

Answer 1

每個進程都有自己的內存和地址空間。所以ReadProcessMemory()和WriteProcessMemory（）使用中間緩衝區來完成他們訪問另一個進程的內存的工作。

不幸的是，您的通話ReadProcessMemory()問題：

• 你不初始化ptrAddress指向一個緩衝區
• 你傳遞的ptrAddress地址，而不是它的值應該指向有效緩衝區
• 您傳遞0（即nullptr）而不是傳遞應該包含可以讀取的字節數的zie變量的地址。

另請注意，您使用DWORD對LPCVOID管理目標進程中的地址。第一個總是32位，而後者取決於您的編譯選項（32位代碼或64位代碼）。

如果發生故障，您還應該驗證error code。幾乎可以肯定，特殊的特權需要在不同的流程中進行讀寫。

這裏有一個調整後的代碼，帶有一些診斷信息以幫助您進一步。

HWND hWnd = FindWindow(0, TEXT("WindowName")); 
if (hWnd == 0) { 
    std::cerr << "Cannot find window." << std::endl; 
} 
else { 
    DWORD pId; 
    GetWindowThreadProcessId(hWnd, &pId); 
    HANDLE hProc = OpenProcess(PROCESS_ALL_ACCESS, FALSE, pId); 
    if (hProc) { 
     char *newString = "newvalue"; 
     size_t sz = strlen(newString) + 1; 
     LPVOID baseAddress = (LPVOID)0x009B03D0; 
     DWORD offset = 0xA7; 
     LPVOID ptrAddress = new char[sz]; 
     SIZE_T bytes_read = 0, bytes_written=0; 
     if (ReadProcessMemory(hProc, baseAddress, ptrAddress, sz, &bytes_read) || GetLastError()== ERROR_PARTIAL_COPY) { 
      if (bytes_read == 0) 
       std::cerr << "Houston, we have a problem..." << std::endl; 
      if(!WriteProcessMemory(hProc, baseAddress, (LPCVOID)newString, sz, &bytes_written)) 
       std::cerr << "Couldn't write process memory:" << GetLastError() << std::endl; 
      std::cout << "Done. " << bytes_read <<" bytes read and "<<bytes_written<<" bytes written"<< std::endl; 
     } 
     else { 
      std::cerr<< "Couldn't read process memory:" << GetLastError() << std::endl; 
     } 
     delete[] ptrAddress; 
    } 
    else { 
     std::cerr << "Couldn't open process " << pId << ": " << GetLastError() << std::endl; 
    } 
} 
std::getchar();