扫描进程虚拟内存数据区域的问题
SYSTEM_INFO SystemInfo;
ZeroMemory((void *)&SystemInfo,sizeof(SystemInfo));
GetSystemInfo( &SystemInfo);
DWORD high = (DWORD)SystemInfo.lpMaximumApplicationAddress;
DWORD low = (DWORD)SystemInfo.lpMinimumApplicationAddress;
HANDLE handPross;
handPross=OpenProcess(PROCESS_ALL_ACCESS, FALSE, m_dwProssId);
MEMORY_BASIC_INFORMATION mi;
VirtualQueryEx(handPross, (void *)low, &mi,sizeof(mi));
int nSizePage=0;
for(low;low<high;)
{
int dwAddress;
if(mi.State == MEM_COMMIT&&mi.AllocationProtect==PAGE_READWRITE)//设置搜索条件
for(dwAddress=0;dwAddress<(int)mi.RegionSize;dwAddress+=4)
{
DWORD lpleng;
DWORD dw;
ReadProcessMemory(handPross,(void *)low,(LPVOID)&dw,4,&lpleng);
if(dw==val_word)//val_word为我要搜索的值
{
CString st1;
st1.Format("地址 %0X 值%d",low,dw);
MessageBox(st1);
}
low+=4;
}
ZeroMemory((void *)&mi,sizeof(mi));
VirtualQueryEx(handPross, (void *)low, &mi,sizeof(mi));
}
我用mi.State == MEM_COMMIT&&mi.AllocationProtect==PAGE_READWRITE这样的条件定义的时候扫描一个最简单的进程也有十来M,扫描QQ有75M左右,这样扫描空间是不是太大了?还有没有能扫描只有数据区域的方法?还有当我扫描一个程序的时候N久都没扫描完,而我用金山游侠的时候几乎1秒就搞定了,还进行了三种方式的扫描(BYTE,short,UINT),为什么金山游侠能那么快?请高手指点~谢谢~~~