访问其他程序使用的内存 [英] Accessing memory used by other program

问题描述

今天我又有一个奇怪的问题(至少对我来说是这样).我正在对指针进行更多的实验，并在我的脑海中激起一个想法，如下所示:

Today I've a weird question again (at least to me it is). I'm experimenting more into pointers and an idea arouse in my mind as follows:

int * firefoxmemory = (char*) 0x11111111 //this is just an example of address.
*firefoxmemory = 200;

问题:

在上面的代码中，我尝试访问firefox使用的内存(我使用内存编辑器查看地址)，然后更改其对应的值.但是当我尝试这样做时，我的程序崩溃了.

The Question:

In the above code, I try to access memory used by firefox (I use a memory editor to view the address) and after that change its corresponding value. But when I try to do so my program crashes.

为什么我的程序会发生这种情况? Firefox是否使用一些特殊的代码来防止第三方程序篡改其内存?还是由Windows和Intel硬件DEP完成的?

Why does this happen to my program? Is there some special code used by Firefox to prevent a 3rd party program from tampering with its memory? Or it's done by the Windows and Intel hardware DEP?

如果DEP阻止了上述操作，为什么某些内存编辑软件仍然可以工作，例如可以更改内存值的作弊引擎?

If the above action is prevented by DEP, why does some memory editing software still work, like cheat engines that can alter values in memory?

推荐答案

它崩溃，因为0x11111111没有指向应用程序内存空间内的有效地址.

It crashes because 0x11111111 does not point to a valid address within your app's memory space.

对于作弊引擎，有两种方法可以访问另一个程序的内存:

As for cheat engine, there are a couple of ways to access another program's memory:

1)在目标进程的内存空间内运行代码.有多种方法可以使用SetWindowsHookEx()或CreateRemoteThread()将代码注入另一个进程.

1) run code inside the target process's memory space. There are various ways to inject code into another process using SetWindowsHookEx() or CreateRemoteThread().

2)使用ReadProcessMemory()和WriteProcessMemory()

这篇关于访问其他程序使用的内存的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！