C++ memory lookup instance

This article illustrates the C++ memory search method, to share for your reference. The details are as follows:

Memory search function in Windows programming, the main program code is as follows:

//Memrepair.cpp: defines the entry point for the console application. & have spent < br / >
//  

  

#include "stdafx.h"  

#include <Windows.h>  

  

BOOL FindFirst(DWORD dwValue);  

BOOL FindNext(DWORD dwValue);  

HANDLE g_hProcess;  

DWORD g_arList[1024];  

DWORD g_nListCnt;  

  

BOOL CompareAPage(DWORD dwBaseAddr, DWORD dwValue)  

{  

    //Read a page of memory & NBSP; < br / >
    BYTE arBytes[4096];  

    BOOL bRead = ::ReadProcessMemory(g_hProcess, (LPVOID)dwBaseAddr, arBytes, 4096,NULL);  

    if (bRead == FALSE)  

    {  

        return FALSE;  

    }  

    DWORD *pdw;  

    for (int i=0;i<4096-4;i++)  

    {  

          

        pdw = (DWORD*)&arBytes[i];   

        if (pdw[0] == dwValue)  

        {  

            g_arList[g_nListCnt++] = dwBaseAddr+i;  

        }  

        /* Error, the address should be converted to DWORD*, The point to DWORD And then get it back [0] 

        if ((DWORD)&arBytes[i] == dwValue) 

        { 

            g_arList[g_nListCnt++] = dwBaseAddr+i; 

        } 

        */  

    }  

    if (g_nListCnt > 1024)  

    {  

        printf("the position is large than 1024..");  

        return FALSE;  

    }  

    return TRUE;  

}  

  

BOOL FindFirst(DWORD dwValue)  

{  

    const DWORD dwOneGB = 1 * 1024 *1024 *1024; // 1GB  

    const DWORD dwOnePage = 4* 1024; // 4K  

    DWORD dwBase;  

    OSVERSIONINFO versionInfo={0};  

    versionInfo.dwOSVersionInfoSize = sizeof(OSVERSIONINFO);  

  

    ::GetVersionEx(&versionInfo);  

    if (versionInfo.dwPlatformId ==  VER_PLATFORM_WIN32_WINDOWS ) //win98  

    {  

        dwBase = 4 * 1024 *1024; // 4MB  

    }  

    else  

    {  

        dwBase = 64 * 1024; // 64KB  

    }  

    //From the starting address to 2GB space lookup & NBSP; < br / >
    for (;dwBase<2*dwOneGB;dwBase+=dwOnePage)  

    {  

        CompareAPage(dwBase,dwValue);  

    }  

    return TRUE;  

}  

  

BOOL FindNext(DWORD dwValue)  

{  

    DWORD dwOriCnt = g_nListCnt;  

    DWORD dwReadValue;  

    BOOL bRet = FALSE;  

  

    g_nListCnt = 0;  

    for (int i=0;i<dwOriCnt;i++)  

    {  

        if (::ReadProcessMemory(g_hProcess,(LPVOID)g_arList[i],&dwReadValue,sizeof(DWORD),0))  

        {  

            if (dwReadValue == dwValue)  

            {  

                g_arList[g_nListCnt++] = g_arList[i];  

                bRet = TRUE;              

            }  

        }  

    }  

    return bRet;  

}  

  

void ShowList()  

{  

    for (int i=0;i<g_nListCnt;i++)  

    {  

        printf("%08lXn", g_arList[i]);  

    }  

}  

BOOL WriteMemory(DWORD dwAddr, DWORD dwValue)  

{  

    //Error: write &dwValue instead of (LPVOID) dwValue& cake; < br / >
    return WriteProcessMemory(g_hProcess,(LPVOID)dwAddr,&dwValue,sizeof(DWORD),NULL);  

}  

int _tmain(int argc, _TCHAR* argv[])  

{  

    g_nListCnt = 0;  

    memset(g_arList,0,sizeof(g_arList));  

  

    char szCommandLine[]="c:\testor.exe";  

    STARTUPINFO si={sizeof(STARTUPINFO)};  

    si.dwFlags = STARTF_USESHOWWINDOW;  

    si.wShowWindow = TRUE;  

  

    PROCESS_INFORMATION pi;  

    BOOL bRet = CreateProcess(NULL, szCommandLine,NULL,NULL,FALSE,CREATE_NEW_CONSOLE,NULL,NULL,&si,&pi);  

    if (bRet == FALSE)  

    {  

        printf("createProcess failed...");  

        return -1;  

    }  

    ::CloseHandle(pi.hThread);  

    g_hProcess = pi.hProcess;  

    //Enter the modified value & NBSP; < br / >
    int iVal;  

    printf("Input iVal=");  

    scanf("%d", &iVal);  

    //Conduct the first lookup & NBSP; < br / >
    FindFirst(iVal);  

    //Printout & NBSP; < br / >
    ShowList();  

  

    //Find it again & NBSP; < br / >
    while (g_nListCnt > 1)  

    {  

        printf("input iVal:n");  

        scanf("%d",&iVal);  

        FindNext(iVal);  

        ShowList();  

    }  

  

    //Modify the value & have spent < br / >
    printf("input new value:n");  

    scanf("%d",&iVal);  

    if (WriteMemory(g_arList[0],iVal))  

    {  

        printf("write suc...");  

    }  

      

    ::CloseHandle(g_hProcess);  

    return 0;  

}

The test program code is as follows:

#include "stdafx.h"  

#include <stdio.h>  

  

int g_nNum = 1003;  

int _tmain(int argc, _TCHAR* argv[])  

{  

    int i = 200;  

    while(1)  

    {  

        printf("i=%d,&i=%08lX...g_nNum=%d,&g_nNum=%08lXnn",i--,&i,--g_nNum,&g_nNum);  

        getchar();  

    }  

      

    return 0;  

}

Hope that the article described in the C++ programming to help you.