VirtualAllocEx 跨进程读写数据 代码注入
2008-04-15 16:33
218 查看
VirtualAllocEx 函数的作用是在指定进程的虚拟空间保留或提交内存区域,除非指定MEM_RESET参数,否则将该内存区域置0。
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/None.gif)
LPVOID VirtualAllocEx(
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/None.gif)
HANDLE hProcess, // 申请内存所在的进程句柄
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/None.gif)
LPVOID lpAddress, // 保留页面的内存地址;一般用NULL自动分配
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/None.gif)
SIZE_T dwSize, // 欲分配的内存大小,字节单位;注意实际分 配的内存大小是页内存大小的整数倍
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/None.gif)
DWORD flAllocationType,
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/None.gif)
DWORD flProtect
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/None.gif)
);
flAllocationType,flProtect太多了,参数数值和意思MSDN上都有,不再赘述了.
问题描述:我要选中其他进程的一个ListView窗口中的一个Item,事实上只要发消息就可以了:
SendMessage( hWnd, LVM_SETITEMSTATE, (WPARAM)nItemIndex, (LPARAM)pLVItem );
可是其中的LPARAM要指向一个LVItem的结构,我们知道消息可以跨进程,但目标窗口收到消息时它需要寻址这个结构,而这个结构实际上存储在发送方的地址空间里;所以我们必须把LVItem的内容写入到窗口过程所在的地址空间内,于是便需要VirtualAllocEx和VirtualFreeEx了。
代码如下。
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/None.gif)
ListViewOperator::ListViewOperator( HWND hWnd ) // 初始化函数
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/ExpandedBlockStart.gif)
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/ContractedBlock.gif)
...{
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/InBlock.gif)
m_hwnd = NULL; //目标窗口
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/InBlock.gif)
m_hProcess = NULL; //目标进程
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/InBlock.gif)
m_pLVItem = NULL; //写入目标进程的LVITEM结构
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/InBlock.gif)
m_pTextBuffer = NULL; //其他用途
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/InBlock.gif)
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/InBlock.gif)
m_hwnd = hWnd;
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/InBlock.gif)
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/InBlock.gif)
DWORD dwProcessId;
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/InBlock.gif)
GetWindowThreadProcessId( hWnd, &dwProcessId ); //获取进程ID
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/InBlock.gif)
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/InBlock.gif)
m_hProcess = OpenProcess( PROCESS_ALL_ACCESS, false, dwProcessId ); //打开进程
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/InBlock.gif)
THROW_EXCEPTION( (m_hProcess == NULL), "Open process failed" );
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/InBlock.gif)
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/InBlock.gif)
m_pLVItem = (LVITEMA *)VirtualAllocEx( m_hProcess, NULL, sizeof(LVITEMA), MEM_COMMIT, PAGE_READWRITE ); 在目标进程空间中获得内存,允许读取和写入。
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/InBlock.gif)
THROW_EXCEPTION( (m_pLVItem == NULL), "Memory alloc failed" );
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/InBlock.gif)
m_pTextBuffer = (char *)VirtualAllocEx( m_hProcess, NULL, MAX_TEXT_BUFFER_LENGTH, MEM_COMMIT, PAGE_READWRITE );
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/InBlock.gif)
THROW_EXCEPTION( (m_pTextBuffer == NULL), "Memory alloc failed" );
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/InBlock.gif)
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/ExpandedBlockEnd.gif)
}
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/None.gif)
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/None.gif)
void ListViewOperator::SetItemSelected( int nItemIndex ) //选中某一个ITEM
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/ExpandedBlockStart.gif)
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/ContractedBlock.gif)
...{
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/InBlock.gif)
LVITEMA lvitem; // 静态结构
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/InBlock.gif)
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/InBlock.gif)
lvitem.mask = LVIF_STATE;
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/InBlock.gif)
lvitem.iSubItem = 0;
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/InBlock.gif)
lvitem.state = LVIS_SELECTED|LVIS_FOCUSED;
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/InBlock.gif)
lvitem.stateMask = LVIS_SELECTED|LVIS_FOCUSED;
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/InBlock.gif)
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/InBlock.gif)
int nRet = WriteProcessMemory( m_hProcess, m_pLVItem, &lvitem, sizeof(LVITEM), NULL ); // 将本地进程中的结构写入到目标进程
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/InBlock.gif)
THROW_EXCEPTION( (nRet == 0), "Write Process memory failed" );
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/InBlock.gif)
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/InBlock.gif)
HRESULT hRet = SendMessage( m_hwnd, LVM_SETITEMSTATE, (WPARAM)nItemIndex, (LPARAM)m_pLVItem );//发送消息
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/InBlock.gif)
THROW_EXCEPTION( FAILED(hRet), "Send message failed" );
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/InBlock.gif)
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/InBlock.gif)
return ;
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/ExpandedBlockEnd.gif)
}
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/None.gif)
LPVOID VirtualAllocEx(
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/None.gif)
HANDLE hProcess, // 申请内存所在的进程句柄
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/None.gif)
LPVOID lpAddress, // 保留页面的内存地址;一般用NULL自动分配
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/None.gif)
SIZE_T dwSize, // 欲分配的内存大小,字节单位;注意实际分 配的内存大小是页内存大小的整数倍
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/None.gif)
DWORD flAllocationType,
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/None.gif)
DWORD flProtect
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/None.gif)
);
flAllocationType,flProtect太多了,参数数值和意思MSDN上都有,不再赘述了.
问题描述:我要选中其他进程的一个ListView窗口中的一个Item,事实上只要发消息就可以了:
SendMessage( hWnd, LVM_SETITEMSTATE, (WPARAM)nItemIndex, (LPARAM)pLVItem );
可是其中的LPARAM要指向一个LVItem的结构,我们知道消息可以跨进程,但目标窗口收到消息时它需要寻址这个结构,而这个结构实际上存储在发送方的地址空间里;所以我们必须把LVItem的内容写入到窗口过程所在的地址空间内,于是便需要VirtualAllocEx和VirtualFreeEx了。
代码如下。
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/None.gif)
ListViewOperator::ListViewOperator( HWND hWnd ) // 初始化函数
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/ExpandedBlockStart.gif)
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/ContractedBlock.gif)
...{
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/InBlock.gif)
m_hwnd = NULL; //目标窗口
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/InBlock.gif)
m_hProcess = NULL; //目标进程
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/InBlock.gif)
m_pLVItem = NULL; //写入目标进程的LVITEM结构
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/InBlock.gif)
m_pTextBuffer = NULL; //其他用途
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/InBlock.gif)
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/InBlock.gif)
m_hwnd = hWnd;
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/InBlock.gif)
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/InBlock.gif)
DWORD dwProcessId;
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/InBlock.gif)
GetWindowThreadProcessId( hWnd, &dwProcessId ); //获取进程ID
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/InBlock.gif)
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/InBlock.gif)
m_hProcess = OpenProcess( PROCESS_ALL_ACCESS, false, dwProcessId ); //打开进程
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/InBlock.gif)
THROW_EXCEPTION( (m_hProcess == NULL), "Open process failed" );
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/InBlock.gif)
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/InBlock.gif)
m_pLVItem = (LVITEMA *)VirtualAllocEx( m_hProcess, NULL, sizeof(LVITEMA), MEM_COMMIT, PAGE_READWRITE ); 在目标进程空间中获得内存,允许读取和写入。
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/InBlock.gif)
THROW_EXCEPTION( (m_pLVItem == NULL), "Memory alloc failed" );
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/InBlock.gif)
m_pTextBuffer = (char *)VirtualAllocEx( m_hProcess, NULL, MAX_TEXT_BUFFER_LENGTH, MEM_COMMIT, PAGE_READWRITE );
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/InBlock.gif)
THROW_EXCEPTION( (m_pTextBuffer == NULL), "Memory alloc failed" );
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/InBlock.gif)
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/ExpandedBlockEnd.gif)
}
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/None.gif)
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/None.gif)
void ListViewOperator::SetItemSelected( int nItemIndex ) //选中某一个ITEM
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/ExpandedBlockStart.gif)
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/ContractedBlock.gif)
...{
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/InBlock.gif)
LVITEMA lvitem; // 静态结构
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/InBlock.gif)
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/InBlock.gif)
lvitem.mask = LVIF_STATE;
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/InBlock.gif)
lvitem.iSubItem = 0;
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/InBlock.gif)
lvitem.state = LVIS_SELECTED|LVIS_FOCUSED;
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/InBlock.gif)
lvitem.stateMask = LVIS_SELECTED|LVIS_FOCUSED;
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/InBlock.gif)
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/InBlock.gif)
int nRet = WriteProcessMemory( m_hProcess, m_pLVItem, &lvitem, sizeof(LVITEM), NULL ); // 将本地进程中的结构写入到目标进程
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/InBlock.gif)
THROW_EXCEPTION( (nRet == 0), "Write Process memory failed" );
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/InBlock.gif)
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/InBlock.gif)
HRESULT hRet = SendMessage( m_hwnd, LVM_SETITEMSTATE, (WPARAM)nItemIndex, (LPARAM)m_pLVItem );//发送消息
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/InBlock.gif)
THROW_EXCEPTION( FAILED(hRet), "Send message failed" );
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/InBlock.gif)
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/InBlock.gif)
return ;
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/ExpandedBlockEnd.gif)
}
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/None.gif)
相关文章推荐
- 转:向其他进程注入代码的三种方法
- 向一个运行中的进程注入自己的代码
- ASP.NET中读写cookie数据示例代码
- 向其他进程注入代码的三种方法
- 通过smali注入的方式插入自定义代码来监控app的行为数据
- 向其他进程注入代码的三种方法
- 恢复 SQL 被注入后的数据代码
- 向其他进程注入代码的三种方法(injectdll)
- linux c之管道的介绍、创建关闭和简单读写(父进程向子进程写入数据)
- [原创&译]向其他进程注入代码的三种方法
- 向其他进程注入代码的三种方法
- [原创&译]向其他进程注入代码的三种方法
- 给Source Insight做个外挂系列之二--将本地代码注入到Source Insight进程
- 向其他进程注入代码的三种方法
- 向其他进程注入代码的三种方法
- 进程注入代码三种方法
- 向其他进程注入代码的三种方法
- Java虚拟机访问读写其他进程的数据--RandomAccessFile
- 向其他进程注入代码的三种方法
- 向其余进程注入代码地三种办法