ReadProcessMemory 跨模块边界

debugcn 发表于 Dev

恶霸Wii广场

我正在使用ReadProcessMemory读取进程的内存。似乎当我读取模块的末尾时，其余字节未成功读取。我还收到以下内核错误：

299: Only part of a ReadProcessMemory or WriteProcessMemory request was completed.

如果我用列出所有模块EnumProcessModules，它们都不包含我试图读取的地址，但Cheat Engine可以很好地显示所有内存内容。Cheat Engine说模块的大小是0xE000，这正是我在它停止之前可以读取的字节数，并且只将0x00字节放入缓冲区，这是不正确的，并不代表实际的内存内容。

以下代码是否不适合跨模块边界读取（即使它们是连续的）？

static Memory getOutputMemory(Pointer openedProcess, long baseAddress, int length)
{
    val outputMemory = new Memory(length);
    val intByReference = new IntByReference();
    if (!MY_KERNEL_32.ReadProcessMemory(openedProcess, baseAddress,
            outputMemory, (int) outputMemory.size(), intByReference))
    {
        checkForKernelError();
    }

    return outputMemory;
}

恶霸Wii广场

事实证明，单独读取内存页面是如何做到的，例如像下面的代码：

public byte[] readBytes(long address, int length)
{
    val byteBuffer = allocate(length);

    var totalRemainingLength = length;
    var currentAddress = address;

    while (totalRemainingLength > 0)
    {
        val memoryBasicInformation = new MEMORY_BASIC_INFORMATION();
        val process = new HANDLE(processHandle);
        val pointer = new Pointer(currentAddress);
        val memoryPageQueryResult = KERNEL_32.VirtualQueryEx(process, pointer, memoryBasicInformation,
                new BaseTSD.SIZE_T(memoryBasicInformation.size()));
        if (memoryPageQueryResult.equals(new SIZE_T(0)))
        {
            throw new IllegalStateException("Memory not contiguous");
        }

        val memoryPageBaseAddress = nativeValue(memoryBasicInformation.baseAddress);
        val memoryPageSize = memoryBasicInformation.regionSize.longValue();
        val memoryPageEndAddress = memoryPageBaseAddress + memoryPageSize;

        val remainingMemoryPageBytes = memoryPageEndAddress - address;
        val currentLength = (int) min(totalRemainingLength, remainingMemoryPageBytes);
        val outputMemory = getOutputMemory(processHandle, currentAddress, currentLength);
        val byteArray = outputMemory.getByteArray(0, currentLength);
        byteBuffer.put(byteArray);

        currentAddress += currentLength;
        totalRemainingLength -= currentLength;
    }

    return byteBuffer.array();
}

static Memory getOutputMemory(Pointer openedProcess, long baseAddress, int length)
{
    val outputMemory = new Memory(length);
    val intByReference = new IntByReference();
    if (!MY_KERNEL_32.ReadProcessMemory(openedProcess, baseAddress,
            outputMemory, (int) outputMemory.size(), intByReference))
    {
        checkForKernelError();
    }

    return outputMemory;
}

本文收集自互联网，转载请注明来源。

如有侵权，请联系[email protected] 删除。