如果您使用的是 Python，也许 ptrace 会有所帮助。它是跨平台的，可以从 pip 安装。这是我在这里抓取的 unix 代码片段：http: //sixserv.org/2010/07/26/memory-debugging-or-a-universal-game-trainer-with-python-and-ptrace/
def search_memory_locations(pid, max_memory, search_value):
child_pid = os.fork()
if child_pid == 0: # search within forked process:
locations = list()
prev_locations = read_locations()
dbg = PtraceDebugger()
process = dbg.addProcess(pid, False)
memory_mappings = readProcessMappings(process)
print "\x1B[?25l", # deactivate cursor (^_^)
for memory_mapping in memory_mappings:
# only search in read/writable memory areas within range...
if "rw" in memory_mapping.permissions and memory_mapping.end <= max_memory:
for loc in range(memory_mapping.start, memory_mapping.end):
value = process.readBytes(loc, 1)
if value[0] == search_value:
print "search memory area[0x%08X-0x%08X] address[0x%08X] value[0x%02X (%03d)] \r" % (memory_mapping.start, memory_mapping.end, loc, ord(value), ord(value)),
if prev_locations and len(prev_locations) > 0 and not loc in prev_locations:
continue # skip prev not found locations
locations.append(loc)
print "\x1B[?25h", # activate cursor
dbg.quit()
write_locations(locations)
sys.exit()
return child_pid # don't really need this
如果您使用的是 C/C++，这是我之前从 ITH ( http://code.google.com/p/interactive-text-hooker/ ) 使用的特定于 Windows 的函数：
DWORD SearchPattern(DWORD base, DWORD base_length, LPVOID search, DWORD search_length) //KMP
{
__asm
{
mov eax,search_length
alloc:
push 0
sub eax,1
jnz alloc
mov edi,search
mov edx,search_length
mov ecx,1
xor esi,esi
build_table:
mov al,byte ptr [edi+esi]
cmp al,byte ptr [edi+ecx]
sete al
test esi,esi
jz pre
test al,al
jnz pre
mov esi,[esp+esi*4-4]
jmp build_table
pre:
test al,al
jz write_table
inc esi
write_table:
mov [esp+ecx*4],esi
inc ecx
cmp ecx,edx
jb build_table
mov esi,base
xor edx,edx
mov ecx,edx
matcher:
mov al,byte ptr [edi+ecx]
cmp al,byte ptr [esi+edx]
sete al
test ecx,ecx
jz match
test al,al
jnz match
mov ecx, [esp+ecx*4-4]
jmp matcher
match:
test al,al
jz pre2
inc ecx
cmp ecx,search_length
je finish
pre2:
inc edx
cmp edx,base_length //search_length
jb matcher
mov edx,search_length
dec edx
finish:
mov ecx,search_length
sub edx,ecx
lea eax,[edx+1]
lea ecx,[ecx*4]
add esp,ecx
}
}