EN:(1、原型 2.Parameter 3.Return Value 4.Requirement 5.See Also)

二、CH:(1.ReadProcessMemory 2、参数)

三、例子(1、C++ 2、Delphi 3、C#)

EN:

1、原型

This function reads memory in a specified process. The entire area to be read must be accessible or the operation fails.

BOOL ReadProcessMemory(

HANDLE hProcess,

LPCVOID lpBaseAddress,

LPVOID lpBuffer,

DWORD nSize,

LPDWORD lpNumberOfBytesRead

);

2.Parameter

（1）hProcess

[in] Handle to the process whose memory is being read.

In Windows CE, any call to OpenProcess returns a process handle with the proper access rights.

（2）lpBaseAddress

[in] Pointer to the base address in the specified process to be read.

Before data transfer occurs, the system verifies that all data in the base address and memory of the specified size is accessible for read access. If so, the function proceeds; otherwise, the function fails.

（3）lpBuffer

[out] Pointer to a buffer that receives the contents from the address space of the specified process.

（4）nSize

[in] Specifies the requested number of bytes to read from the specified process.

（5）lpNumberOfBytesRead

[out] Pointer to the number of bytes transferred into the specified buffer.

If lpNumberOfBytesRead is NULL, the parameter is ignored.

3.Return Value

Nonzero indicates success.

Zero indicates failure.

To get extended error information, call GetLastError.

The function fails if the requested read operation crosses into an area of the process that is inaccessible.

Remarks

ReadProcessMemory copies data in the specified address range from the address space of the specified process into the specified buffer of the current process. The process whose address space is read is typically, but not necessarily, being debugged.

The entire area to be read must be accessible. If it is not, the function fails.

4.Requirement

OS Versions: Windows CE 2.0 and later.

Header: Winbase.h.

Link Library: Coredll.lib, Nk.lib.

5.See Also

OpenProcess | WriteProcessMemory

---------------------------------------------------------------------------------------

二、CH:

1.ReadProcessMemory

BOOL ReadProcessMemory(

HANDLE hProcess,

PVOID pvAddressRemote,

PVOIDpvBufferLocal,

DWORD dwSize,

PDWORDpdwNumBytesRead

);

2、参数

hProcess [in]远程进程句柄。 被读取者

pvAddressRemote [in]远程进程中内存地址。 从具体何处读取

pvBufferLocal [out]本地进程中内存地址. 函数将读取的内容写入此处

dwSize [in]要传送的字节数。要写入多少

pdwNumBytesRead [out]实际传送的字节数. 函数返回时报告实际写入多少

三、例子

1、C++

ReadProcessMemory读出数据，权限要大一些。下面这个打开进程的方式具备了 查询 读和写的权限

hProcess = OpenProcess(PROCESS_QUERY_INFORMATION Or PROCESS_VM_OPERATION Or PROCESS_VM_READ Or PROCESS_VM_WRITE, 0, ProcessId)

2、Delphi

var

hProcess:HWND;

wltId:DWord;

hProcess:=OpenProcess(PROCESS_CREATE_THREAD + PROCESS_VM_OPERATION+ PROCESS_VM_WRITE, FALSE, wltId);

然后就要结合上面的程序来搜索了。只有当内存是处于被占用状态时才去读取其中的内容，而忽略空闲状态的内存。程序我就不在这儿写了，和上面那段差不多。只是把dwTotalCommit = dwTotalCommit + mi.RegionSize换成了读取内存以及搜索这一块内存的函数而已。

1.通过FindWindow读取窗体的句柄

2.通过GetWindowThreadProcessId读取查找窗体句柄进程的PID值

var

nProcId:DWord;

nProcId:=GetWindowThreadProcessId(hFound, @nProcId);

3.用OpenProcess(PROCESS_QUERY_INFORMATION Or PROCESS_VM_OPERATION Or PROCESS_VM_READ Or PROCESS_VM_WRITE, 0, ProcessId)打开查到PID值的进程. 此打开具备读取,写入,查询的权限

4.ReadProcessMemory读出指定的内存地址数据

BOOL ReadProcessMemory(

HANDLE hProcess, // 被读取进程的句柄；

LPCVOID lpBaseAddress, // 读的起始地址；

LPVOID lpBuffer, // 存放读取数据缓冲区；

DWORD nSize, // 一次读取的字节数；

LPDWORD lpNumberOfBytesRead // 实际读取的字节数；

);

例题：

ReadProcessMemoryX(dwProcessId, (LPVOID)数据地址, szPassBuff, sizeof(szPassBuff), 0);

3、C#

/// <summary>

/// 从指定内存中读取字节集数据

/// </summary>

/// <param name="handle">进程句柄</param>

/// <param name="address">内存地址</param>

/// <param name="data">数据存储变量</param>

/// <param name="size">长度</param>

/// <param name="read">读取长度</param>

[DllImport("Kernel32.dll")]

private static extern void ReadProcessMemory(IntPtr handle, uint address, [Out] byte[] data, int size, int read);