Alirezanet
جمعه 03 فروردین 1397, 11:17 صبح
Imports System
Imports System.Diagnostics
Imports System.Runtime.InteropServices
Imports System.Text
Public Class MemoryRead
Const PROCESS_WM_READ As Integer = &H10
<DllImport("kernel32.dll")> _
Public Shared Function OpenProcess(dwDesiredAccess As Integer, bInheritHandle As Boolean, dwProcessId As Integer) As IntPtr
End Function
<DllImport("kernel32.dll")> _
Public Shared Function ReadProcessMemory(hProcess As Integer, lpBaseAddress As Integer, lpBuffer As Byte(), dwSize As Integer, ByRef lpNumberOfBytesRead As Integer) As Boolean
End Function
Public Shared Sub Main()
Dim process As Process = Process.GetProcessesByName("notepad")(0)
Dim processHandle As IntPtr = OpenProcess(PROCESS_WM_READ, False, process.Id)
Dim bytesRead As Integer = 0
Dim buffer As Byte() = New Byte(24) {}
''Hello World!' takes 12*2 bytes because of Unicode
' 0x0046A3B8 is the address where I found the string, replace it with what you found
ReadProcessMemory(CType(processHandle, Integer), &H46a3b8, buffer, buffer.Length, bytesRead)
Console.WriteLine(Encoding.Unicode.GetString(buffe r) + " (" + bytesRead.ToString() + "bytes)")
Console.ReadLine()
End Sub
End Class
Imports System
Imports System.Diagnostics
Imports System.Runtime.InteropServices
Imports System.Text
Public Class MemoryRead
Const PROCESS_VM_WRITE As Integer = &H20
Const PROCESS_VM_OPERATION As Integer = &H8
<DllImport("kernel32.dll")> _
Public Shared Function OpenProcess(dwDesiredAccess As Integer, bInheritHandle As Boolean, dwProcessId As Integer) As IntPtr
End Function
<DllImport("kernel32.dll", SetLastError := True)> _
Shared Function WriteProcessMemory(hProcess As Integer, lpBaseAddress As Integer, lpBuffer As Byte(), dwSize As Integer, ByRef lpNumberOfBytesWritten As Integer) As Boolean
End Function
Public Shared Sub Main()
Dim process As Process = Process.GetProcessesByName("notepad")(0)
Dim processHandle As IntPtr = OpenProcess(&H1f0fff, False, process.Id)
Dim bytesWritten As Integer = 0
Dim buffer As Byte() = Encoding.Unicode.GetBytes("It works!" & vbNullChar)
' '\0' marks the end of string
' replace 0x0046A3B8 with your address
WriteProcessMemory(CType(processHandle, Integer), &H46a3b8, buffer, buffer.Length, bytesWritten)
Console.ReadLine()
End Sub
End Class