江湖博客

ReadProcessMemory

ReadProcessMemory归属为为编程中的内存操作函数，

 其作用为根据进程句柄读入该进程的某个内存空间； 

函数原型为

BOOL ReadProcessMemory(HANDLE hProcess, LPCVOID lpBaseAddress, LPVOID lpBuffer, DWORD nSize, LPDWORD lpNumberOfBytesRead);

 由布尔声明可以看出， 当函数读取成功时返回1， 失败则返回0， 具体参数含义将在下文中指出。

原型

This function reads memory in a specified process. The entire area to be read must be accessible or the operation fails.

BOOL ReadProcessMemory(
    HANDLE hProcess,
    LPCVOID lpBaseAddress,
    LPVOID lpBuffer,
    DWORD nSize,
    LPDWORD lpNumberOfBytesRead
);

参数

（1）hProcess

[in] Handle to the process whose memory is being read.

In Windows CE, any call to OpenProcess returns a process handle with the proper access rights.

（2）lpBaseAddress

[in] Pointer to the base address in the specified process to be read.

Before data transfer occurs, the system verifies that all data in the base address and memory of the specified size is accessible for read access. If so, the function proceeds; otherwise, the function fails.

（3）lpBuffer

[out] Pointer to a buffer that receives the contents from the address space of the specified process.

（4）nSize

[in] Specifies the requested number of bytes to read from the specified process.

（5）lpNumberOfBytesRead

[out] Pointer to the number of bytes transferred into the specified buffer.

If lpNumberOfBytesRead is NULL, the parameter is ignored.

返回值

Nonzero indicates success.

Zero indicatesfailure.

To get extended error information, call GetLastError.

The function fails if the requested read operation crosses into an area of the process that is inaccessible.

Remarks

ReadProcessMemory copies data in the specified address range from the address space of the specified process into the specified buffer of the current process. The process whose address space is read is typically, but not necessarily, being debugged.

The entire area to be read must be accessible. If it is not, the function fails.

要求

OS Versions: Windows CE 2.0 and later.

Header: Winbase.h.

Link Library: Coredll.lib, Nk.lib.

参考

OpenProcess | WriteProcessMemory

---------------------------------------------------------------------------------------

中文解释编辑

ReadProcessMemory

BOOL ReadProcessMemory(

HANDLE hProcess,

PVOID pvAddressRemote,

PVOIDpvBufferLocal,

DWORD dwSize,

PDWORDpdwNumBytesRead

);

实际应用

hProcess [in]远程进程句柄。 被读取者

pvAddressRemote [in]远程进程中内存地址。 从具体何处读取

pvBufferLocal [out]本地进程中内存地址. 函数将读取的内容写入此处

dwSize [in]要传送的字节数。要写入多少

pdwNumBytesRead [out]实际传送的字节数. 函数返回时报告实际写入多少

例子编辑

C++

ReadProcessMemory读出数据，权限要大一些。下面这个打开进程的方式具备了 查询 读和写的权限

hProcess = OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_OPERATION | PROCESS_VM_READ | PROCESS_VM_WRITE, 0, ProcessId)

Delphi

var

hProcess:HWND;

wltId:DWord;

hProcess:=OpenProcess(PROCESS_CREATE_THREAD + PROCESS_VM_OPERATION+ PROCESS_VM_WRITE, FALSE, wltId);

然后就要结合上面的程序来搜索了。只有当内存是处于被占用状态时才去读取其中的内容，而忽略空闲状态的内存。程序我就不在这儿写了，和上面那段差不多。只是把dwTotalCommit = dwTotalCommit + mi.RegionSize换成了读取内存以及搜索这一块内存的函数而已。

1.通过FindWindow读取窗体的句柄

2.通过GetWindowThreadProcessId读取查找窗体句柄进程的PID值

var

nProcId:DWord;

nProcId:=GetWindowThreadProcessId(hFound, @nProcId);

3.用OpenProcess(PROCESS_QUERY_INFORMATION Or PROCESS_VM_OPERATION Or PROCESS_VM_READ Or PROCESS_VM_WRITE, 0, ProcessId)打开查到PID值的进程. 此打开具备读取,写入,查询的权限

4.ReadProcessMemory读出指定的内存地址数据

BOOL ReadProcessMemory(

HANDLE hProcess, // 被读取进程的句柄；

LPCVOID lpBaseAddress, // 读的起始地址；

LPVOID lpBuffer, // 存放读取数据缓冲区；

DWORD nSize, // 一次读取的字节数；

LPDWORD lpNumberOfBytesRead // 实际读取的字节数；

);

例题：

ReadProcessMemory(dwProcessId, (LPVOID)数据地址, szPassBuff, sizeof(szPassBuff), 0);