zoukankan      html  css  js  c++  java
  • 如何获取 程序加载后的内存起始地址

    Public Function GetProcessPath(ByVal dwProcessId As Long) As String 
        Dim ntStatus As Long 
        Dim objBasic As PROCESS_BASIC_INFORMATION 
        Dim objFlink As Long 
        Dim objPEB As Long, objLdr As Long 
        Dim objBaseAddress As Long 
        Dim bytName(260 * 2 - 1) As Byte 
        Dim strModuleName As String, objName As Long 
        Dim objCid As CLIENT_ID 
        Dim objOa As OBJECT_ATTRIBUTES 
        Dim i As Integer 
        Dim hProcess As Long 
        objOa.Length = Len(objOa) 
        objCid.UniqueProcess = dwProcessId 
        ntStatus = NtOpenProcess(hProcess, PROCESS_QUERY_INFORMATION Or PROCESS_VM_READ, objOa, objCid) 
        If hProcess = 0 Then 
            hProcess = GetHandleByProcessId(dwProcessId) 
            If hProcess = 0 Then 
                GetProcessPath = "" 
                Exit Function 
            End If 
        End If 
        Dim lngRet As Long, lngReturn As Long 
        ntStatus = NtQueryInformationProcess(hProcess, ProcessBasicInformation, VarPtr(objBasic), Len(objBasic), ByVal 0&) 
        If (NT_SUCCESS(ntStatus)) Then 
            objPEB = objBasic.PebBaseAddress 
            lngRet = ReadProcessMemory(hProcess, ByVal objPEB + &HC, objLdr, 4, ByVal 0&) 
            lngRet = ReadProcessMemory(hProcess, ByVal objLdr + &HC, objFlink, 4, ByVal 0&) 
            lngRet = ReadProcessMemory(hProcess, ByVal objFlink + &H18, objBaseAddress, 4, ByVal 0&) 
            If objBaseAddress > 0 Then 
                lngRet = ReadProcessMemory(hProcess, ByVal objFlink + &H28, objName, 4, ByVal 0&) 
                lngRet = ReadProcessMemory(hProcess, ByVal objName, bytName(0), 260 * 2, ByVal 0&) 
                If ERROR_PARTIAL_COPY = lngRet Then 
    Start: 
                    i = i + 1 
                    If ERROR_PARTIAL_COPY = ReadProcessMemory(hProcess, ByVal objName, bytName(0), 260 * 2 - i, ByVal 0&) Then 
                        GoTo Start 
                    End If 
                End If 
                strModuleName = bytName 
                strModuleName = Left(strModuleName & Chr(0), InStr(strModuleName & Chr(0), Chr(0)) - 1) 
                GetProcessPath = strModuleName 
            End If 
        End If 
        NtClose hProcess 
    End Function 

    看这里objBaseAddress 这个就是你要的东西

  • 相关阅读:
    (转)CSS3之pointer-events(屏蔽鼠标事件)属性说明
    Linux下source命令详解
    控制台操作mysql常用命令
    解决beego中同时开启http和https时,https端口占用问题
    有关亚马逊云的使用链接收集
    favicon.ico--网站标题小图片二三事
    网络博客
    Gitbook 命令行工具
    Markdown 轻量级标记语言
    SVN 集中式版本控制系统
  • 原文地址:https://www.cnblogs.com/yulei126/p/6790282.html
Copyright © 2011-2022 走看看