windows-遍歷另一進程記憶體根據進程PID

• 2019 年 12 月 26 日
• 筆記

#include <windows.h>  //OpenProcess需要提權,因為程式碼常用摳出來的所有沒有提權.  BOOL iteratorMemory(DWORD dwPid)  {      if (dwPid == 0 || dwPid == 4)          return FALSE;          HANDLE hProcess = 0;      DWORD dwTempSize = 0;      hProcess = OpenProcess(PROCESS_ALL_ACCESS,FALSE,dwPid);      if (!hProcess)      {            return FALSE;      }        PMEMORY_BASIC_INFORMATION pMemInfo = new MEMORY_BASIC_INFORMATION();      DWORD dwErrorCode;      dwErrorCode = VirtualQueryEx(hProcess, 0, pMemInfo, sizeof(MEMORY_BASIC_INFORMATION));      if (0 == dwErrorCode)      {          return FALSE;      }          // pMeminfo->Regionsize 代表當前遍歷出的記憶體大小      for (__int64 i = pMemInfo->RegionSize; i < (i + pMemInfo->RegionSize); i += pMemInfo->RegionSize)      {            dwErrorCode = VirtualQueryEx(hProcess, (LPVOID)i, pMemInfo, sizeof(MEMORY_BASIC_INFORMATION));          if (0 == dwErrorCode)              break;            if (pMemInfo->State != MEM_COMMIT)      //判斷提交狀態              continue;            if (pMemInfo->Protect != PAGE_READWRITE) //判斷記憶體屬性          {              continue;          }                if (pMemInfo->Type != MEM_PRIVATE)      //判斷類型 映射 私有 xxx          {              continue;          }              continue;        }        return FALSE;    }

原理: 原理主要是 使用 ** VirtualQueryEx ** 函數. 函數遍歷之後會將記憶體資訊回饋到一個Buf中.這個Buf是個結構體 ** PMEMORY_BASIC_INFORMATION **