我正在使用下面的方法来读取内存中的字节。我想读取彼此非常接近的内存地址中的值。以前,我一直在对内存中的每个字节进行单独调用,并使用 for 循环将结果添加到数组中。这变得非常低效,所以我想修改下面的代码来读取一大块内存,然后尝试对数组进行迭代以提取我想要的字节。我花了一些时间试图解决它,但真的很挣扎。仅供参考,此方法读取指针,然后如果该值是指针,则读取该指针,依此类推,直到到达静态地址,然后读取该地址处的字节值。
[DllImport("kernel32", EntryPoint = "ReadProcessMemory")]
private static extern byte ReadProcessMemoryByte(int Handle, int Address, ref byte Value, int Size, ref int BytesRead);
public static byte ReadPointerByte(string EXENAME, int Pointer, int[] Offset)
{
byte Value = 0;
checked
{
try
{
Process[] Proc = Process.GetProcessesByName(EXENAME);
if (Proc.Length != 0)
{
int Bytes = 0;
int Handle = OpenProcess(PROCESS_ALL_ACCESS, 0, Proc[0].Id);
if (Handle != 0)
{
foreach (int i in Offset)
{
ReadProcessMemoryInteger((int)Handle, Pointer, ref Pointer, 4, ref Bytes);
Pointer += i;
}
ReadProcessMemoryByte((int)Handle, Pointer, ref Value, 2, ref Bytes);
CloseHandle(Handle);
}
}
}
catch
{ }
}
return Value;
}
到目前为止我所拥有的:
private void label1_Click(object sender, EventArgs e)
{
int[] valuesSeperated[200];
List<byte> PreArray = new List<byte>();
Process[] test = Process.GetProcessesByName("MyProcess"); //Get process handle
int baseAddress = test[0].MainModule.BaseAddress.ToInt32(); //Get base address
byte ReadX = MyClass.ReadPointerByte("MyProcess", BaseAddress, new int[] { 0xc, 0x0, 0x2 }); //call memory reading function (including memory offsets)
PreArray.Add(ReadX);
byte[] PreArrayToInt = PreArray.ToArray();
int[] MYConvertedBytes = PreArray ToInt.Select(x => (int)x).ToArray();
foreach (int i in MYConvertedBytes)
{
valuesSeperated // (don't really know what to do here, if the read was successful I would have a long number at [0], so now need to seperate these as if I had read each one in memory one at a time.
}
string TestString = MYConvertedBytes[0].ToString();
label1.Text = TestString;
}
总结一下:我不知道如何使用上述方法读取更大的内存块(一次说 200 个地址)。我不知道如何最好地从结果数组中提取值以形成一个新数组,该数组现在已分离字节。请询问是否有任何不清楚的地方,我很新,真的很想学习,所以任何提示/帮助将不胜感激。