好的...我想让 win32api WriteProcessMemory 工作。
(只是为了在.Net平台上学习winAPI!^___^)
我正在使用 Nemerle,但语法与 C# 相似,我可以肯定地阅读 C# 代码。
所以这是我的步骤:
1)获取win api函数
[DllImport("kernel32.dll",SetLastError = true)]
public static extern WriteProcessMemory
(hProcess : IntPtr,
lpBaseAddress : int,
lpBuffer : array[byte],
nSize : int,
lpNumberOfBytesWritten : out int) : bool;
2)打开进程,获取调试权限^_^和...调用函数
def WriteToMem(ProcessHandle : IntPtr, BaseAddress : int, NewVal : array[byte]) : bool
{
mutable BytesWritten : int = 0;
WriteProcessMemory(ProcessHandle, BaseAddress, NewVal, NewVal.Length, out BytesWritten)
}
3) 参数:
PatchOptions.noerror =
if (this.textBox1.Text=="" && !this.checkBox1.Checked)
{
MessageBox.Show("Wind header caption could not be empty");
false
}
else
if (this.textBox4.Text=="" && this.checkBox1.Checked)
{
MessageBox.Show("Process Id could not be empty");
false
}
else
if (this.textBox2.Text=="")
{
MessageBox.Show("BaseAddress could not be empty");
false
}
else
if (this.textBox3.Text=="")
{
MessageBox.Show("NewValue could not be empty");
false
}
else
{
try
{
if(checkBox1.Checked)
{
PatchOptions.WinHeader=this.textBox4.Text.ToString();
PatchOptions.window=false;
}
else
{
PatchOptions.WinHeader=this.textBox1.Text.ToString();
PatchOptions.window=true;
}
PatchOptions.BaseAddress=Int32.Parse( this.textBox2.Text.ToString() );
PatchOptions.NewValue=BitConverter.GetBytes(Int32.Parse(this.textBox3.Text.ToString()));
this.Close();
true
}
catch
{
e is Exception => MessageBox.Show("You entered incorrect values.");
false
}
}
4)调用:
def isinjected() : string
{
if (Options.PatchOptions.noerror)
{
try
{
Memory.Patch(Options.PatchOptions.WinHeader,Options.PatchOptions.BaseAddress,Options.PatchOptions.NewValue,Options.PatchOptions.window);
}
catch
{
| e is Exception => MessageBox.Show("Memory Patching error");
""
}
}
else
{
MessageBox.Show("Patch options Error");
""
}
}
def injection = isinjected();
unless (injection=="")
this.label1.Text =injection;
5)记事本ShowStatus偏移:D(用于测试)
00b550d2 - 89 35 2c c0 b5 00 - mov [00b5c02c],esi
00b5509d - 89 3d 2c c0 b5 00 - mov [00b5c02c],edi
6)使用win Calc将十六进制转换为十进制:(这里有麻烦)
00b550d2 = B550D2 = 11882706 ...希望它是正确的(我猜这是基地址)嗯... NewValue 是什么?以及如何将字节数组输入为整数:S
请帮帮我>_<