我想要访问某个进程的某个地址。但是,我需要先获得进程的基地址。我使用一个工具,看看我是否真的做到正确。该工具显示我需要以下:app.exe+ 0x011F9B08 = 0x119F8300
I want to access a certain address of a process. But for that i need to get the base address of the process first. I'm using a tool to see if i'm actually doing it right. The tool shows i need the following: "app.exe"+0x011F9B08 = 0x119F8300
一个进程的基地址通过 OpenProcess(),但是给我: 0x0000005c 结果。我不认为是对的吗?至少,不是我需要的。
I thought i could obtain the base address of a process through OpenProcess(), but that gives me: 0x0000005c as a result. I don't think that is right? Atleast, not what i need.
我认为我需要的基地址是: 0x119F8300 - 0x011F9B08 = 0x107FE7F8
I think the base address i need is: 0x119F8300 - 0x011F9B08 = 0x107FE7F8 <-- base?
这是我的代码:
hWindow = FindWindow(NULL, lpWindowName); if(hWindow) { GetWindowThreadProcessId(hWindow, &dwProcId); if(dwProcId != 0) { // hProcHandle -> 0x0000005c hProcHandle = OpenProcess(PROCESS_ALL_ACCESS, FALSE, dwProcId); } else { return 0; } }如何获取进程的基地址
推荐答案如果要在其他进程的地址空间中获取虚拟地址 >,您可以这样做:
If you want to get the virtual address within the other process's address space, you can do that like so:
这将给你虚拟地址,但是你可以做的很多,因为它没有映射到当前进程的地址空间。
This will give you the virtual address, but there's not a whole lot you can do with it since it's not mapped into your current process's address space.
更多推荐
获取进程的基地址
发布评论