[求助]哪位查看哪里不同? - VC++/MFC - C++论坛

| 网站首页 | 业界新闻 | 小组 | 威客 | 人才 | 下载频道 | 博客 | 代码贴 | 在线编程 | 编程论坛 |

编程论坛 → 开发语言 → C++论坛 → 『 VC++/MFC 』 → [求助]哪位查看哪里不同?

我的收件箱(0)

欢迎加入我们，一同切磋技术

共有 437 人关注过本帖

标题：[求助]哪位查看哪里不同?

只看楼主加入收藏

Janlex

等　级：新手上路
威　望：6
帖　子：303
专家分：0
注　册：2006-9-12

楼主

问题点数：0 回复次数：7

[求助]哪位查看哪里不同?

void SearchQQNumber(HANDLE hProcess)
{
SuspendThread(hProcess); //挂载

SYSTEM_INFO info;
GetSystemInfo(&info);

char lpBuffer[4096] = {0};
DWORD yetReadSize = 0;
MEMORY_BASIC_INFORMATION memBasicInfo;

DWORD dwBaseAddress = (DWORD)info.lpMinimumApplicationAddress;

while (dwBaseAddress < (DWORD)info.lpMaximumApplicationAddress)
{
VirtualQueryEx(hProcess, (LPVOID)dwBaseAddress, &memBasicInfo, sizeof(memBasicInfo));
dwBaseAddress = (DWORD)memBasicInfo.BaseAddress + memBasicInfo.RegionSize;

if (memBasicInfo.State != MEM_COMMIT || memBasicInfo.AllocationProtect != PAGE_READWRITE)
{
continue;
}

for (DWORD dw = (DWORD)memBasicInfo.BaseAddress; dw < dwBaseAddress; dw += 4096);
{
if (!ReadProcessMemory(hProcess, (LPCVOID)dw, lpBuffer, 4096, &yetReadSize))
continue;

for (int fin = 0; fin < 4096-8; fin++)
{
if ( !memcmp(&lpBuffer[fin], "MsgEx.db", 8) )
{
char *t=&lpBuffer[fin-10];
lpBuffer[fin-1] = '\0';
printf("%s\n", t);
}
}
}
}
ResumeThread(hProcess);
return;

}

2007-11-02 14:49

Janlex

等　级：新手上路
威　望：6
帖　子：303
专家分：0
注　册：2006-9-12

第 2 楼

得分:0

void SeachQQNumber(HANDLE hProcess)
{
SuspendThread(hProcess);

SYSTEM_INFO info;
GetSystemInfo(& info);

char lpBuffer[4096] = { 0 };
DWORD yetReadSize = 0;
MEMORY_BASIC_INFORMATION memBasicInfo;

DWORD dwBaseAddress = (DWORD)info.lpMinimumApplicationAddress;

if (memBasicInfo.State != MEM_COMMIT || memBasicInfo.AllocationProtect != PAGE_READWRITE)
{
continue;
}

for (DWORD dw = (DWORD)memBasicInfo.BaseAddress; dw < dwBaseAddress; dw += 4096 )
{
if( !ReadProcessMemory(hProcess,LPCVOID(dw),lpBuffer, 4096, & yetReadSize))
continue;

for (int fin=0 ;fin <4096 - 8 ;fin++)
{

if (!memcmp( & lpBuffer[fin], "MsgEx.db" , 8 ) )
{
char *t=&lpBuffer[fin-10];
lpBuffer[fin-1] = '\0';
printf("%s\n", t);
}
}
}
}
ResumeThread(hProcess);
return;
}