搜索内存数据

1、#include #include #include BOOL FindFirst(DWORD dwVilue);BOOL FindNext(DWORD dwVilue);DWORD g_arList1024;int g_nListCnt;HANDLE g_hProcess;BOOL CompareAPage(DWORD dwBaseAddr,DWORD dwValue) /allot memory to sava bufferedwordsBYTE arBytes4096;/return bool,the size of a page is 4kb,the last one is retur

2、n valueif(上:ReadProcessMemory(g_hProcess,(LPVOID)dwBaseAddr,arBytes,4096,NULL) return FALSE;DWORD* pdw;for(int i=0;i=1024)return FALSE;将地址送入地址数组g_arListg_nListCnt+=dwBaseAddr+i;return TRUE;void ShowList()for(int i=0;i1)printf(Input val=);scanf(”d”,&iVil);/search the nextFindNext(iVal);/display the r

3、esultsShowList();printf(New value=);scanf(”d”,&iVil);if(WriteMemory(g_arList0,iVhl)printf(Write data successn);:CloseHandle(g_hProcess);return 0;BOOL FindFirst(DWORD dwVilue)const DWORD dwOneGB=1024*1024*1024;const DWORD dwOnePage=4*1024;if(g_hProcess=NULL)return FALSE;DWORD dwBase;OSVERSIONINFO vi=

4、sizeof(vi);:GetVersionEx(&vi);if(vi.dwPlatformId=VER_PLATFORM_WIN32_WINDOWS)dwBase=4*1024*1024;elsedwBase=640*1024;for(;dwBase2*dwOneGB;dwBase+=dwOnePage)CompareAPage(dwBase,dwValue);return TRUE;BOOL FindNext(DWORD dwValue) /save the number of the effective addressesof ARRAY m_arList,initializethe n

5、ew value of m_arListint nOrgCnt=g_nListCnt;g_nListCnt=0;/find according the address of ARRAYm_arListBOOL bRet=FALSE;DWORD dwReadValue;for(int i=0;inOrgCnt;i+)if(:ReadProcessMemory(g_hProcess,(LPVOID)g_arListi,&dwReadVilue,sizeof(DWORD) ,NULL)if(dwReadValue=dwValue)g_arListg_nListCnt+=g_arListi;bRet=

6、TRUE;for(int i=g_nListCnt;inOrgCnt;i+)g_arListi=0;return bRet;程序开始声明了 2个后面的函数，另外还有3个GLOBAL变量一个是作为地址列表的，另一个是存放地址个数的，最后一个是句柄。Winsows采用的是4KB为一页的内存管理机制，为提高搜索目标的效率先在一页中（即4KB） 搜索。函数COMPAREAPAGE （DWORD，DWORD）就是实现此功能的。此函数用了 READPROCESSMEMORY（DWORD，DWORD），来读取一页中的数据，并返 回布尔值。将读取的数据送到缓冲区数组中，对缓冲区进行遍历搜索，每次搜索4个字节（即 一个DWORD型数据），总共搜索4*1024-3次，如果有，则将地