C#: Search a byte[] array in another process's memory

后端 未结 5 1662
夕颜
夕颜 2020-12-09 13:23

How is it possible to search for a byte[] array in the memory of another process and then get the address at the place where the byte[] array is located?

I want to w

5条回答
  •  时光说笑
    2020-12-09 13:58

    This may help you find the right way:

    private static int GetMemoryAddressOfString(byte[] searchedBytes, Process p)
    {
        //List addrList = new List();
        int addr = 0;
        int speed = 1024*64;
        for (int j = 0x400000; j < 0x7FFFFFFF; j+= speed)
        {
            ManagedWinapi.ProcessMemoryChunk mem = new ProcessMemoryChunk(p, (IntPtr)j, speed + searchedBytes.Length);
    
            byte[] bigMem = mem.Read();
    
            for (int k = 0; k < bigMem.Length - searchedBytes.Length; k++)
            {
                bool found = true;
                for (int l = 0; l < searchedBytes.Length; l++)
                {
                    if(bigMem[k+l] != searchedBytes[l])
                    {
                        found = false;
                        break;
                    }
                }
                if(found)
                {
                    addr = k+j;
                    break;
                }
            }
            if (addr != 0)
            {
                //addrList.Add(addr);
                //addr = 0;
                break;
            }
        }
        //return addrList;
        return addr;
    }
    

提交回复
热议问题