通过WriteProcessMemory改写进程的内存

以PROCESS_ALL_ACCESS权限打开进程以后既可以使用ReadProcessMemory读取程序内存，也可以使用WriteProcessMemory改写程序的内存，这也是一些内存补丁使用的招数，以下是程序的实现代码

Code
#include <windows.h>
#include <stdio.h>
LRESULT CALLBACK _procWinMain(HWND,UINT,WPARAM,LPARAM);
int WINAPI WinMain(HINSTANCE hInstance,HINSTANCE hPrevInstance,LPSTR lpCmdLine,int nCmdShow)
{
HWND hWinMain,hButton1,hButton2;
MSG stMsg;
WNDCLASSEX stWndClass;
RtlZeroMemory(&stWndClass,sizeof(stWndClass));//WNDCLASSEX结构置零
//注册窗口类
stWndClass.hCursor=::LoadCursor(0,IDC_ARROW);
stWndClass.hInstance=hInstance;
stWndClass.cbSize=sizeof(WNDCLASSEX);
stWndClass.style=CS_HREDRAW||CS_VREDRAW;
stWndClass.lpfnWndProc=_procWinMain;
stWndClass.hbrBackground=(HBRUSH)GetStockObject(BLACK_BRUSH);
stWndClass.lpszClassName="myclass";
::RegisterClassEx(&stWndClass);
//建立并显示窗口
hWinMain=::CreateWindowEx(WS_EX_CLIENTEDGE,"myclass","firstwindow",WS_OVERLAPPEDWINDOW,100,100,600,400,NULL,NULL,hInstance,NULL);
//建立按钮
hButton1=::CreateWindowEx(NULL,"BUTTON","button1",WS_VISIBLE|WS_CHILD,300,200,60,20,hWinMain,(HMENU)1,hInstance,NULL);
hButton2=::CreateWindowEx(NULL,"BUTTON","button2",WS_VISIBLE|WS_CHILD,100,200,60,20,hWinMain,(HMENU)2,hInstance,NULL);

::ShowWindow(hWinMain,SW_SHOWNORMAL);
::UpdateWindow(hWinMain);
while(1)
{
if(::GetMessage(&stMsg,NULL,0,0)==0)//消息为WM_QUIT
break;
else
{
::TranslateMessage(&stMsg);
::DispatchMessage(&stMsg);
}
}
return 0;
}
LRESULT CALLBACK _procWinMain(HWND hWnd,UINT uMsg,WPARAM wParam,LPARAM lParam)
{
if(uMsg==WM_CLOSE)
{
::DestroyWindow(hWnd);
}
else if(uMsg==WM_DESTROY)
{
::PostQuitMessage(NULL);
}
else if(uMsg==WM_COMMAND)
{
char temp1[256],temp2[256];
::itoa((int)wParam,temp1,10);
::strcpy(temp2,"wParam: ");
::strcat(temp2,temp1);
::strcat(temp2," lParam: ");
::itoa((int)lParam,temp1,10);
::strcat(temp2,temp1);
::strcat(temp2," mess");
::MessageBox(NULL,temp2,"command",MB_OK);
}
else
{
return ::DefWindowProc(hWnd,uMsg,wParam,lParam);
}
return 0;
}

这个程序的功能是在窗口上建立两个button，点击任何一个button都会弹出一个对话框，输出button回调函数的wParam、lParam参数的值，外加一段字符串“mess”，我们要修改的就是字符串“mess”的第一个字符“m”为“a”。

将两端代码编译以后先打开button程序，点击窗口上的任意一个按钮，应该弹出如下的对话框：


此时打开改写内存的程序，然后再点击button程序窗口上的按钮，弹出的窗口就变成了下图：



字符串mess成功地修改为aess！