VB.NET中的动态内存编辑 [英] Dynamic Memory Editing in VB.NET

问题描述

我正在编写一个内存编辑程序，我在查找如何在VB中找到动态内存地址时遇到了一些麻烦。我发现很容易找到并写入静态地址，但我想知道如何在VB.NET中查找和编辑动态内存地址？



这是我编写的静态编辑函数。



Public Sub WriteInteger（ByVal ProcessName As String，ByVal Address As Integer，ByVal Value As Integer，Optional ByVal nsize如整数= 4）

如果ProcessName.EndsWith（。exe）那么

ProcessName = ProcessName.Replace（。exe，）

结束如果

Dim MyP As Process（）= Process.GetProcessesByName（ProcessName）

如果MyP.Length = 0那么

MessageBox.Show（ProcessName&未打开！）

退出Sub

结束如果

Dim hProcess As IntPtr = OpenProcess（PROCESS_ALL_ACCESS ，0，MyP（0）.Id）

如果hProcess = IntPtr.Zero那么

MessageBox.Show（无法打开&Proce ssName&！）

退出Sub

结束如果



Dim hAddress，vBuffer As Integer

hAddress =地址

vBuffer =价值

WriteProcessMemory1（hProcess，hAddress，CInt（vBuffer），nsize，0）

结束Sub

Hi,

I am writing a memory editing program and I am having some trouble figuring out how to find a dynamic memory address in VB. I've found it is really easy to find and write to a static address, but I'm wondering how do you find and edit a dynamic memory address in VB.NET?

Here's the static editing function I have written.

Public Sub WriteInteger(ByVal ProcessName As String, ByVal Address As Integer, ByVal Value As Integer, Optional ByVal nsize As Integer = 4)
If ProcessName.EndsWith(".exe") Then
ProcessName = ProcessName.Replace(".exe", "")
End If
Dim MyP As Process() = Process.GetProcessesByName(ProcessName)
If MyP.Length = 0 Then
MessageBox.Show(ProcessName & " isn't open!")
Exit Sub
End If
Dim hProcess As IntPtr = OpenProcess(PROCESS_ALL_ACCESS, 0, MyP(0).Id)
If hProcess = IntPtr.Zero Then
MessageBox.Show("Failed to open " & ProcessName & "!")
Exit Sub
End If

Dim hAddress, vBuffer As Integer
hAddress = Address
vBuffer = Value
WriteProcessMemory1(hProcess, hAddress, CInt(vBuffer), nsize, 0)
End Sub

推荐答案

这不起作用。首先，没有动态内存地址这样的东西。但是，由此，我假设您正在尝试编辑托管代码进程的内存。在.NET CLR下，托管代码对象可以随时在内存中重定位。所以问题就在于此。



保持物体不被移动的唯一方法是固定它。只有包含该对象的进程才能插入。您正在编辑的进程外部的代码无法固定任何对象。你最大的问题是固定一个对象只适用于指针。您无法从流程外部获取对象的地址。该过程必须向您传递指向该对象的指针。

This isn't going to work. First, there's no such thing as a "dynamic memory address". But, by that, I'm assuming you're trying to edit the memory of a managed code process. Under the .NET CLR, managed code objects can be relocated in memory at any time. so therein lay your problem.

The only way to keep an object from being moved is to "pin it". Only the process that contains the object can pin in. Your code, external to the process being edited, cannot pin any object. Your biggest problem is that pinning an object only works with pointers. You cannot get the address of an object from outside of the process. The process has to pass you a pointer to the object.

您需要找出可以扫描的签名以找到您需要的地址。有许多字节签名来源，请搜索Google以获取您的语言偏好。

You need to figure out a signature you can scan for to find the address you need. There are many Byte Signature sources available, search Google for your language preference.

这篇关于VB.NET中的动态内存编辑的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！