当前位置:编程学习 > VC++ >>

扫描进程虚拟内存数据区域的问题

SYSTEM_INFO SystemInfo; ZeroMemory((void *)&SystemInfo,sizeof(SystemInfo)); GetSystemInfo( &SystemInfo); DWORD high = (DWORD)SystemInfo.lpMaximumApplicationAddress; DWORD low = (DWORD)SystemInfo.lpMinimumApplicationAddress; HANDLE handPross; handPross=OpenProcess(PROCESS_ALL_ACCESS, FALSE, m_dwProssId); MEMORY_BASIC_INFORMATION mi; VirtualQueryEx(handPross, (void *)low, &mi,sizeof(mi)); int nSizePage=0; for(low;low<high;) { int dwAddress; if(mi.State == MEM_COMMIT&&mi.AllocationProtect==PAGE_READWRITE)//设置搜索条件 for(dwAddress=0;dwAddress<(int)mi.RegionSize;dwAddress+=4) { DWORD lpleng; DWORD dw; ReadProcessMemory(handPross,(void *)low,(LPVOID)&dw,4,&lpleng); if(dw==val_word)//val_word为我要搜索的值 { CString st1; st1.Format("地址 %0X 值%d",low,dw); MessageBox(st1); } low+=4; } ZeroMemory((void *)&mi,sizeof(mi)); VirtualQueryEx(handPross, (void *)low, &mi,sizeof(mi)); } 我用mi.State == MEM_COMMIT&&mi.AllocationProtect==PAGE_READWRITE这样的条件定义的时候扫描一个最简单的进程也有十来M,扫描QQ有75M左右,这样扫描空间是不是太大了?还有没有能扫描只有数据区域的方法?还有当我扫描一个程序的时候N久都没扫描完,而我用金山游侠的时候几乎1秒就搞定了,还进行了三种方式的扫描(BYTE,short,UINT),为什么金山游侠能那么快?请高手指点~谢谢~~~
CopyRight © 2012 站长网 编程知识问答 www.zzzyk.com All Rights Reserved
部份技术文章来自网络,