搜索内存数据(三)
来源:互联网 发布:彩票缩水软件大全 编辑:程序博客网 时间:2024/06/11 14:06
- Option Base 1
- Option Explicit
- Private Declare Function GetCurrentProcessId Lib "kernel32" () As Long
- Private Const PAGE_READWRITE =
- Private Const MEM_COMMIT =
- Private Type MEMORY_BASIC_INFORMATION
- BaseAddress As Long
- AllocationBase As Long
- AllocationProtect As Long
- RegionSize As Long
- State As Long
- Protect As Long
- lType As Long
- End Type
- Private Declare Function VirtualQueryEx Lib "kernel32" (ByVal hProcess As Long, ByVal lpAddress As Long, lpBuffer As MEMORY_BASIC_INFORMATION, ByVal dwLength As Long) As Long
- Private Declare Sub CopyMemory Lib "kernel32" Alias "RtlMoveMemory" (Destination As Any, Source As Any, ByVal Length As Long)
- Private Declare Function DebugActiveProcess Lib "kernel32" (ByVal dwProcessId As Long) As Long
- Private Declare Function FindWindow Lib "user32" Alias "FindWindowA" (ByVal lpClassName As String, ByVal lpWindowName As String) As Long
- Private Declare Function GetWindowThreadProcessId Lib "user32" (ByVal hWnd As Long, lpdwProcessId As Long) As Long
- Private Const TH32CS_SNAPPROCESS As Long =
- Private Declare Function CreateToolhelp32Snapshot Lib "kernel32" (ByVal lFlags As Long, ByVal lProcessID As Long) As Long
- Private Const MAX_PATH As Integer = 260
- Private Type PROCESSENTRY32
- dwSize As Long
- cntusage As Long
- th32ProcessID As Long
- th32DefaultHeapID As Long
- th32ModuleID As Long
- cntThreads As Long
- th32ParentProcessID As Long
- pcPriClassBase As Long
- dwFlags As Long
- szExeFile As String * MAX_PATH
- End Type
- Private Declare Function Process32First Lib "kernel32" (ByVal hSnapShot As Long, uProcess As PROCESSENTRY32) As Long
- Private Declare Function Process32Next Lib "kernel32" (ByVal hSnapShot As Long, uProcess As PROCESSENTRY32) As Long
- Private Declare Function CloseHandle Lib "kernel32" (ByVal hObject As Long) As Long
- Private Declare Function OpenProcess Lib "kernel32" (ByVal dwDesiredAccess As Long, ByVal bInheritHandle As Long, ByVal dwProcessId As Long) As Long
- Private Const PROCESS_VM_READ As Long = &H10
- Private Const PROCESS_QUERY_INFORMATION As Long = &H400
- Private Const PROCESS_ALL_ACCESS As Long = &H1F0FFFF
- Private Declare Function ReadProcessMemory Lib "kernel32" (ByVal hProcess As Long, lpBaseAddress As Any, lpBuffer As Any, ByVal nSize As Long, lpNumberOfBytesWritten As Long) As Long
- Private Declare Function EnumProcessModules Lib "psapi.dll" (ByVal hProcess As Long, lphModule As Any, ByVal cb As Long, lpcbNeeded As Long) As Boolean
- Private Declare Function GetModuleFileNameEx Lib "psapi" Alias "GetModuleFileNameExA" (ByVal hProcess As Long, ByVal hModule As Long, ByVal lpFilename As String, ByVal nSize As Long) As Long
- Sub Main()
- Dim s As String
- Dim b() As Byte
- Dim nLen As Long
-
- s = "1234567890"
- nLen = Len(s) * 2
- ReDim b(nLen) As Byte
- CopyMemory b(1), ByVal StrPtr(s), nLen
-
- Call Search(b, GetCurrentProcessId())
- End Sub
- Public Sub Search(byteData() As Byte, Optional p_ID As Long = 0, Optional szWindowText As String = "", Optional ByVal lpStart As Long = &H100000, Optional lpEnd As Long = &H7FFFFFFF)
- Dim hWnd As Long
- Dim hProcessID As Long
- Dim hProcessSnapShot As Long
- Dim szModuleName As String
- Dim bSuccessHup As Boolean
- Dim bFoundProcess As Boolean
- Dim stProcess As PROCESSENTRY32
-
- If p_ID > 0 Then
- hProcessID = p_ID
- Else
- If Len(szWindowText) > 0 Then
- hWnd = FindWindow(vbNullString, szWindowText)
- If hWnd = 0 Then Exit Sub
- GetWindowThreadProcessId hWnd, hProcessID
- End If
- End If
- If hProcessID > 0 Then
- Call fnSearch(byteData, hProcessID, lpStart, lpEnd)
- Else
- stProcess.dwSize = Len(stProcess)
- hProcessSnapShot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0&)
- bFoundProcess = Process32First(hProcessSnapShot, stProcess)
- Do While bFoundProcess
- hProcessID = stProcess.th32ProcessID
- szModuleName = Left(stProcess.szExeFile, InStr(stProcess.szExeFile, vbNullChar) - 1)
- Call fnSearch(byteData, hProcessID, lpStart, lpEnd)
- bFoundProcess = Process32Next(hProcessSnapShot, stProcess)
- Loop
- CloseHandle hProcessSnapShot
- End If
- End Sub
- Private Function fnSearch(byteData() As Byte, ByVal p_ID As Long, ByVal lpStart As Long, ByVal lpEnd As Long)
- Dim hProcess As Long
-
- Dim lpBaseAddress As Long
- Dim bSuccess As Boolean
- Dim MBI As MEMORY_BASIC_INFORMATION
- Dim lRet As Long
- Dim mbiSize As Long, bSize As Long, dwNeeded As Long
- Dim lpMBI As Long, lpByte As Long
- Dim lpBuffer() As Byte
- Dim lpszFileName As String
-
- lpBaseAddress = lpStart
- mbiSize = Len(MBI)
- bSize = UBound(byteData)
-
- hProcess = OpenProcess(PROCESS_VM_READ Or PROCESS_QUERY_INFORMATION, False, p_ID)
- If hProcess = 0 Then Exit Function
-
- lpszFileName = String(MAX_PATH, vbNullChar)
- If GetModuleFileNameEx(hProcess, ByVal 0&, lpszFileName, MAX_PATH) Then
- lpszFileName = Left(lpszFileName, InStr(lpszFileName, vbNullChar) - 1)
- End If
- lRet = VirtualQueryEx(hProcess, lpBaseAddress, MBI, mbiSize)
-
- Do While ((lRet > 0) And (lpBaseAddress < lpEnd))
- If (MBI.Protect And PAGE_READWRITE) And (MBI.State = MEM_COMMIT) Then
- ReDim lpBuffer(MBI.RegionSize)
- ReadProcessMemory hProcess, ByVal MBI.BaseAddress, lpBuffer(1), MBI.RegionSize, 0
- For lpMBI = 1 To MBI.RegionSize - bSize
- For lpByte = 1 To bSize
- bSuccess = (lpBuffer(lpMBI + lpByte) = byteData(lpByte))
- If Not bSuccess Then Exit For
- Next
- If bSuccess Then
- Debug.Print "找到目标内容,进程文件:", lpszFileName, "地址:", MBI.BaseAddress + lpMBI
- End If
- Next
- End If
- lpBaseAddress = lpBaseAddress + MBI.RegionSize
- lRet = VirtualQueryEx(hProcess, lpBaseAddress, MBI, mbiSize)
- DoEvents
- Loop
- CloseHandle hProcess
- End Function
- Private Function fnSearch1(byteData() As Byte, ByVal p_ID As Long, ByVal lpStart As Long, ByVal lpEnd As Long)
- Dim hProcess As Long
- Dim lpBaseAddress As Long
- Dim bSuccess As Boolean
- Dim MBI As MEMORY_BASIC_INFORMATION
- Dim lRet As Long
-
- Dim mbiSize As Long, bSize As Long, dwNeeded As Long
- Dim lpMBI As Long, lpByte As Long
- Dim lpMemBuffer() As Long
- Dim lpDataBuffer() As Long
- Dim lpszFileName As String
-
- lpBaseAddress = lpStart
- mbiSize = Len(MBI)
- bSize = UBound(byteData)
- bSize = (bSize / 4) + IIf((bSize Mod 4) <> 0, 1, 0)
- ReDim lpDataBuffer(bSize)
- CopyMemory lpDataBuffer(1), byteData(1), UBound(byteData)
-
- hProcess = OpenProcess(PROCESS_VM_READ Or PROCESS_QUERY_INFORMATION, False, p_ID)
- If hProcess = 0 Then Exit Function
-
- lpszFileName = String(MAX_PATH, vbNullChar)
- If GetModuleFileNameEx(hProcess, ByVal 0&, lpszFileName, MAX_PATH) Then
- lpszFileName = Left(lpszFileName, InStr(lpszFileName, vbNullChar) - 1)
- End If
- lRet = VirtualQueryEx(hProcess, lpBaseAddress, MBI, mbiSize)
-
- Do While ((lRet > 0) And (lpBaseAddress < lpEnd))
- If (MBI.Protect And PAGE_READWRITE) And (MBI.State = MEM_COMMIT) Then
- ReDim lpMemBuffer(MBI.RegionSize)
- ReadProcessMemory hProcess, ByVal MBI.BaseAddress, lpMemBuffer(1), MBI.RegionSize, 0
- For lpMBI = 1 To (MBI.RegionSize / 4 - bSize)
- For lpByte = 1 To bSize
- bSuccess = (lpMemBuffer(lpMBI + lpByte) = lpDataBuffer(lpByte))
- If Not bSuccess Then Exit For
- Next
- If bSuccess Then
- Debug.Print "找到目标内容,进程文件:", lpszFileName, "地址:", MBI.BaseAddress + lpMBI * 4
- End If
- Next
- End If
- lpBaseAddress = lpBaseAddress + MBI.RegionSize
- lRet = VirtualQueryEx(hProcess, lpBaseAddress, MBI, mbiSize)
- DoEvents
- Loop
- CloseHandle hProcess
- End Function