C# ReadProcessMemory:如何读取 64 位内存地址? [英] C# ReadProcessMemory: How to read a 64 bit memory address?

问题描述

我正在阅读应用程序内存.我正在使用 CheatEngine 获取内存地址，然后尝试返回它的值.但是，CheatEngine 似乎返回 64 位内存地址，因此我的 ReadProcessMemory 函数不断告诉我，每当我输入地址时，它都无法将long"转换为int".我发现的所有教程似乎都基于类似 00AB5678 的内存地址，但我得到的教程更像是 D3569227FC.

I am getting into reading application memory. I am using CheatEngine to get a memory address and then trying to return it's value. However, CheatEngine seems to be returning 64 bit memory addresses and so my ReadProcessMemory function keeps on telling me that it cannot convert a 'long' to 'int' whenever I enter in the address. All the tutorials I have found seem to be based on memory addresses that are like 00AB5678 but the ones I am getting are more like D3569227FC.

所以我的问题是，如何使用具有更大内存地址的 ReadProcessMemory?

So my question is, how do I use ReadProcessMemory with much larger memory addresses?

这是我的代码:

using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;
using System.Threading.Tasks;
using System.Runtime.InteropServices;
using System.Diagnostics;

namespace ConsoleApplication1
{
    class Program
    {
        const int PROCESS_WM_READ = 0x0010;

        [DllImport("kernel32.dll")]
        public static extern IntPtr OpenProcess(int dwDesiredAccess, bool bInheritHandle, int dwProcessId);

        [DllImport("kernel32.dll")]
        public static extern bool ReadProcessMemory(int hProcess,
        int lpBaseAddress, byte[] lpBuffer, int dwSize, ref int lpNumberOfBytesRead);

        static void Main(string[] args)
        {
            Process process = Process.GetProcessesByName("MyProgram")[0]; 
            IntPtr processHandle = OpenProcess(PROCESS_WM_READ, false, process.Id); 

            int bytesRead = 0;
            byte[] buffer = new byte[24]; //To read a 24 byte unicode string

            ReadProcessMemory((int)processHandle, 0xD5369227FC, buffer, buffer.Length, ref bytesRead);

            Console.WriteLine(Encoding.Unicode.GetString(buffer) + 
                  " (" + bytesRead.ToString() + "bytes)");
            Console.ReadLine();
        }
    }
}

我已通过进入 VS2012-->Project-->ApplicationName Properties-->Build-->Platform Target-->Change to "x64" 将我的 C# 应用程序转换为 64 位应用程序，现在我只是需要知道如何更改我的代码以读取 64 位地址.

I have converted my C# application to a 64 bit application by going into VS2012-->Project-->ApplicationName Properties-->Build-->Platform Target-->Change to "x64", now I just need to know how to change my code to read 64 bit addresses.

推荐答案

您可以将 lpBaseAddress 路径设为 Int64.尝试更换您的

You can path lpBaseAddress as Int64. Try replace your

[DllImport("kernel32.dll")]
    public static extern bool ReadProcessMemory(int hProcess,
    int lpBaseAddress, byte[] lpBuffer, int dwSize, ref int lpNumberOfBytesRead);

到

[DllImport("kernel32.dll")] 
public static extern bool ReadProcessMemory(int hProcess,
    Int64 lpBaseAddress, byte[] lpBuffer, int dwSize, ref int lpNumberOfBytesRead); 

但最正确的实现:

[DllImport("kernel32.dll")]
static extern bool ReadProcessMemory(IntPtr hProcess,
    IntPtr lpBaseAddress, [Out] byte[] lpBuffer, int dwSize, out IntPtr lpNumberOfBytesRead);

这篇关于C# ReadProcessMemory:如何读取 64 位内存地址?的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！