C＃ReadProcessMemory：如何读取64位内存地址？ [英] C# ReadProcessMemory: How to read a 64 bit memory address?

问题描述

我正在读取应用程序内存。我正在使用CheatEngine获取内存地址，然后尝试返回其值。但是，CheatEngine似乎正在返回64位内存地址，因此我的ReadProcessMemory函数不断告诉我，无论何时输入地址，它都无法将 long转换为 int。我发现的所有教程似乎都是基于类似于00AB5678的内存地址，但是我得到的却更像是D3569227FC。

I am getting into reading application memory. I am using CheatEngine to get a memory address and then trying to return it's value. However, CheatEngine seems to be returning 64 bit memory addresses and so my ReadProcessMemory function keeps on telling me that it cannot convert a 'long' to 'int' whenever I enter in the address. All the tutorials I have found seem to be based on memory addresses that are like 00AB5678 but the ones I am getting are more like D3569227FC.

所以我的问题是，怎么办我使用ReadProcessMemory具有更大的内存地址吗？

So my question is, how do I use ReadProcessMemory with much larger memory addresses?

这是我的代码：

using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;
using System.Threading.Tasks;
using System.Runtime.InteropServices;
using System.Diagnostics;

namespace ConsoleApplication1
{
    class Program
    {
        const int PROCESS_WM_READ = 0x0010;

        [DllImport("kernel32.dll")]
        public static extern IntPtr OpenProcess(int dwDesiredAccess, bool bInheritHandle, int dwProcessId);

        [DllImport("kernel32.dll")]
        public static extern bool ReadProcessMemory(int hProcess,
        int lpBaseAddress, byte[] lpBuffer, int dwSize, ref int lpNumberOfBytesRead);

        static void Main(string[] args)
        {
            Process process = Process.GetProcessesByName("MyProgram")[0]; 
            IntPtr processHandle = OpenProcess(PROCESS_WM_READ, false, process.Id); 

            int bytesRead = 0;
            byte[] buffer = new byte[24]; //To read a 24 byte unicode string

            ReadProcessMemory((int)processHandle, 0xD5369227FC, buffer, buffer.Length, ref bytesRead);

            Console.WriteLine(Encoding.Unicode.GetString(buffer) + 
                  " (" + bytesRead.ToString() + "bytes)");
            Console.ReadLine();
        }
    }
}

编辑：我已经转换了我的通过进入VS2012-> Project-> ApplicationName属性-> Build-> Platform Target->更改为 x64，将C＃应用程序转换为64位应用程序，现在我只需要知道如何将代码更改为读取64位地址。

I have converted my C# application to a 64 bit application by going into VS2012-->Project-->ApplicationName Properties-->Build-->Platform Target-->Change to "x64", now I just need to know how to change my code to read 64 bit addresses.

推荐答案

您可以将lpBaseAddress设置为Int64。尝试替换您的

You can path lpBaseAddress as Int64. Try replace your

[DllImport("kernel32.dll")]
    public static extern bool ReadProcessMemory(int hProcess,
    int lpBaseAddress, byte[] lpBuffer, int dwSize, ref int lpNumberOfBytesRead);

到

[DllImport("kernel32.dll")] 
public static extern bool ReadProcessMemory(int hProcess,
    Int64 lpBaseAddress, byte[] lpBuffer, int dwSize, ref int lpNumberOfBytesRead); 

但最正确的实现方式：

[DllImport("kernel32.dll")]
static extern bool ReadProcessMemory(IntPtr hProcess,
    IntPtr lpBaseAddress, [Out] byte[] lpBuffer, int dwSize, out IntPtr lpNumberOfBytesRead);

这篇关于C＃ReadProcessMemory：如何读取64位内存地址？的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！