C++內存查找實例

C++內存查找實例。本站提示廣大學習愛好者：（C++內存查找實例）文章只能為提供參考，不一定能成為您想要的結果。以下是C++內存查找實例正文

本文實例講述了C++內存查找的辦法，分享給年夜家供年夜家參考。詳細以下：

windows法式設計中的內存查找功效，主法式代碼以下：

// MemRepair.cpp : 界說掌握台運用法式的進口點。 
// 
 
#include "stdafx.h" 
#include <Windows.h> 
 
BOOL FindFirst(DWORD dwValue); 
BOOL FindNext(DWORD dwValue); 
HANDLE g_hProcess; 
DWORD g_arList[1024]; 
DWORD g_nListCnt; 
 
BOOL CompareAPage(DWORD dwBaseAddr, DWORD dwValue) 
{ 
    //讀取一頁內存 
    BYTE arBytes[4096]; 
    BOOL bRead = ::ReadProcessMemory(g_hProcess, (LPVOID)dwBaseAddr, arBytes, 4096,NULL); 
    if (bRead == FALSE) 
    { 
        return FALSE; 
    } 
    DWORD *pdw; 
    for (int i=0;i<4096-4;i++) 
    { 
         
        pdw = (DWORD*)&arBytes[i];  
        if (pdw[0] == dwValue) 
        { 
            g_arList[g_nListCnt++] = dwBaseAddr+i; 
        } 
        /*失足，應當將地址先轉換成DWORD*,即指向DWORD的地址，然後再取[0]
        if ((DWORD)&arBytes[i] == dwValue)
        {
            g_arList[g_nListCnt++] = dwBaseAddr+i;
        }
        */ 
    } 
    if (g_nListCnt > 1024) 
    { 
        printf("the position is large than 1024.."); 
        return FALSE; 
    } 
    return TRUE; 
} 
 
BOOL FindFirst(DWORD dwValue) 
{ 
    const DWORD dwOneGB = 1 * 1024 *1024 *1024; // 1GB 
    const DWORD dwOnePage = 4* 1024; // 4K 
    DWORD dwBase; 
    OSVERSIONINFO versionInfo={0}; 
    versionInfo.dwOSVersionInfoSize = sizeof(OSVERSIONINFO); 
 
    ::GetVersionEx(&versionInfo); 
    if (versionInfo.dwPlatformId ==  VER_PLATFORM_WIN32_WINDOWS ) //win98 
    { 
        dwBase = 4 * 1024 *1024; // 4MB 
    } 
    else 
    { 
        dwBase = 64 * 1024; // 64KB 
    } 
    //從開端地址到2GB的空間查找 
    for (;dwBase<2*dwOneGB;dwBase+=dwOnePage) 
    { 
        CompareAPage(dwBase,dwValue); 
    } 
    return TRUE; 
} 
 
BOOL FindNext(DWORD dwValue) 
{ 
    DWORD dwOriCnt = g_nListCnt; 
    DWORD dwReadValue; 
    BOOL bRet = FALSE; 
 
    g_nListCnt = 0; 
    for (int i=0;i<dwOriCnt;i++) 
    { 
        if (::ReadProcessMemory(g_hProcess,(LPVOID)g_arList[i],&dwReadValue,sizeof(DWORD),0)) 
        { 
            if (dwReadValue == dwValue) 
            { 
                g_arList[g_nListCnt++] = g_arList[i]; 
                bRet = TRUE;             
            } 
        } 
    } 
    return bRet; 
} 
 
void ShowList() 
{ 
    for (int i=0;i<g_nListCnt;i++) 
    { 
        printf("%08lX\n", g_arList[i]); 
    } 
} 
BOOL WriteMemory(DWORD dwAddr, DWORD dwValue) 
{ 
    //失足的情形：寫入的是&dwValue，而不是（LPVOID）dwValue 
    return WriteProcessMemory(g_hProcess,(LPVOID)dwAddr,&dwValue,sizeof(DWORD),NULL); 
} 
int _tmain(int argc, _TCHAR* argv[]) 
{ 
    g_nListCnt = 0; 
    memset(g_arList,0,sizeof(g_arList)); 
 
    char szCommandLine[]="c:\\testor.exe"; 
    STARTUPINFO si={sizeof(STARTUPINFO)}; 
    si.dwFlags = STARTF_USESHOWWINDOW; 
    si.wShowWindow = TRUE; 
 
    PROCESS_INFORMATION pi; 
    BOOL bRet = CreateProcess(NULL, szCommandLine,NULL,NULL,FALSE,CREATE_NEW_CONSOLE,NULL,NULL,&si,&pi); 
    if (bRet == FALSE) 
    { 
        printf("createProcess failed..."); 
        return -1; 
    } 
    ::CloseHandle(pi.hThread); 
    g_hProcess = pi.hProcess; 
    //輸出修正值 
    int iVal; 
    printf("Input iVal="); 
    scanf("%d", &iVal); 
    //停止第一次查找 
    FindFirst(iVal); 
    //打印成果 
    ShowList(); 
 
    //再次查找 
    while (g_nListCnt > 1) 
    { 
        printf("input iVal:\n"); 
        scanf("%d",&iVal); 
        FindNext(iVal); 
        ShowList(); 
    } 
 
    //修正值 
    printf("input new value:\n"); 
    scanf("%d",&iVal); 
    if (WriteMemory(g_arList[0],iVal)) 
    { 
        printf("write suc..."); 
    } 
     
    ::CloseHandle(g_hProcess); 
    return 0; 
} 

測試用的法式代碼以下：

#include "stdafx.h" 
#include <stdio.h> 
 
int g_nNum = 1003; 
int _tmain(int argc, _TCHAR* argv[]) 
{ 
    int i = 200; 
    while(1) 
    { 
        printf("i=%d,&i=%08lX...g_nNum=%d,&g_nNum=%08lX\n\n",i--,&i,--g_nNum,&g_nNum); 
        getchar(); 
    } 
     
    return 0; 
}

願望本文所述對年夜家的C++法式設計有所贊助。