解析进程在内存中映射的信息

#include <stdio.h>int main (int argc,char **argv){int num1 = 165297;int num2 = 3435235;int num3 = 834834;int num4 = 23453;printf("address is 0x00%x./n",&num1);printf("address is 0x00%x./n",&num2);printf("address is 0x00%x./n",&num3);printf("address is 0x00%x./n",&num4);putchar(16);getchar();return 0;} 

 

上面这个程序是用来测试用的，大体思路是这样的，通过此程序的进程名获得此进程的PID，进而获取进程信息，将进程信息写到自己定义的缓冲区中（考虑到通用性，缓冲区的类型是BYTE），此时缓冲区里面就存放了这个进程的一些信息，由于是BYTE类型的，不是我们要的类型，所以就要解析(笔者解析的是int型数据)主要看看解析方法：

首先，从缓冲区里面按照一定的大小来读去数据量平台的不一样会导致编译结果的不一样，进而内存信息的地址就会有差别，VC6.0下连续的int类型之间没有空余地址，是紧挨着的，但是VS2008就不一样了，她在编译的时候每个int 类型之间留有8个字节的空字节没有用，此时我们在读的时候就应该以12作为步长来读（int 的四字节加上 预留的8个空字节字节）；

下来，就是解析了，笔者利用位操作，将每一个字节的八位数据求出来，存放到一个数组中，数组里存放的就是信息的二进制编码，思路很简单，但是操作起来并不是那样的，举一个例子，拿num1来说，她有四个字节，编译程序的时候一个一个字节都PUSH到栈里面，但是在通过handle读进程信息的时候，会把最后一个字节先读，这样，会导致四个字节数据的逆置，切忌，是四个字节的逆置， 不是左右位的逆置 如下图：

11110000  |  10101000  | 10101010 | 01010101

       1                   2                   3                4

 01010101 | 10101010   | 10101000 | 11110000

4    3 2   1

是字节的逆置，不是位的逆置，此程序当中，四个变量在压栈的时候也满足上面所说，所以解析出的结果，num1，num2，num3，num4也是逆置的。还有一个问题应该注意，那就是在移位操作的时候是从低位开始的取值的，赋值的时候需要从字符串的后面开始赋值，才能取得正确的二进制编码，其实，咱们不需要那样做，大家想一下，咱们是为了解析int，要的是int值，不是二进制编码，利用二进制的零幺编码加上各个位上的权值来算int值的，那么我们就不需要按照逻辑上的从高位到低位来存编码，比如说，咱们算出来的最低位（即第一个算出来的编码）是幺，那么它所确定的值就是1 * 2^0，正好，我们就把第一个权值定义成2^0，也符合认得逻辑思维，权值从小到大排起来。这样以来，按照一个编码对应一个权值就可以把值算出来。此法打破常规，笔者觉得很不错。

接着，我们开始对解析的二进制编码进行int化（笔者把二进制转成int值叫int化），遍历二进制编码数组，遇到幺了就将此时对应的权值加到sum里，最后的结果就是sum，这样就得到那个int值。

注意：在定义全局变量的时候，若要在.cpp文件，和main函数文件中利用那个全局变量，需要在.h文件中声明全局变量为extern的，然后只需要在剩余的那两个.cpp文件中随意的一个文件中定义一下，那么另外一个.cpp文件就知道那个变量是其他文件的了，否则会出现全局变量的多次定义。

下面这个就是我的解析程序，希望大家多提宝贵意见，代码风格，代码解释，语法等，均可提意见，笔者很乐意与大家交流。

////////////////////////////////////////////////////////////////////////////////////////////////////////////////////process.h// name ; deny// date : 10_7_20// function :　get the process's id from a name,than show this process's memory information,and analyse thi information #pragma once#ifndef _DENY_PROCESS_10_7_20__#define _DENY_PROCESS_10_7_20__#include <windows.h>#define FALSE 0#define TRUE 1#define LENGTH 255//the length of the process name#define LEN 32//the length of the numbertypedef int PID_T;//define the type of the pid_ttypedef unsigned long DWORD;extern char name[LENGTH];extern char str[LENGTH][LEN+1];//store the right of binaryextern int right[LEN] ;extern BYTE imemorybuffer[1024];//store the memory information//the function of bit manipulation to a BYTEint Byte_To_Binary(BYTE num,int position,int j);//the function of bit manipulation to typebool Int_To_binary (BYTE* num,int size,int j);//the function of getting a integer form a binaryint Get_Int_From_Binary(int j);//the function prototype of getting the process's PID by process namePID_T Get_Process_Id_By_Name (char *name);//the function prototype of jueging the right returnvoid Judge_Right_Return (DWORD value);//the function prototype of entering the process namechar* Enter_Process_Name ();//the function prototype of gettinig process IDPID_T Get_Id ();//the function prototype of showing process informationDWORD Show_Memory_Information (PID_T pid);#endif////////////////////////////////////////////////////////////////////////////////////////////////////////////////////process.cpp#include <windows.h>#include <tlhelp32.h>// allow calling CreateToolhelp32Snapshot()#include <iostream>#include "process.h"char name[LENGTH];char str[LENGTH][LEN+1];//store the right of binaryint right[LEN] = {1,2,4,8,16,32,64,128,256,512,1024,2048,4096,8192,16384,32768,65536,131072,262144,524288,1048576,2097152,4194304,8388608,16777216,33554432,67108864,134217728,268435456,536870912,1073741824,2147483648};BYTE imemorybuffer[1024];PID_T Get_Process_Id_By_Name (char *name){HANDLE hprocessSnapshot;PROCESSENTRY32 pe32;pe32.dwSize = sizeof (pe32);//give the variable spaces//take a snapshot of all processed in the systemhprocessSnapshot = ::CreateToolhelp32Snapshot( TH32CS_SNAPPROCESS, 0 );//fail to crreatif ( hprocessSnapshot == INVALID_HANDLE_VALUE ){std :: cout << "can't create a snapshot!!!/n";return (FALSE);}//loop the processint bstart = ::Process32First(hprocessSnapshot,&pe32);while (bstart){if (0 == strcmp(pe32.szExeFile,name)){//PBYTE pAddress = GetModuleHandle("gao.exe");//printf("address is 0x00%x./n",pAddress);return (pe32.th32ProcessID);//when the name you type match the process name which has been searched,break it }bstart = ::Process32Next(hprocessSnapshot,&pe32);}if (!bstart)return (FALSE); else return (pe32.th32ProcessID);}//juege the right returnvoid Judge_Right_Return (DWORD value){FALSE == value ? std :: cout << "can't get this process's PID!/n" : std::cout << name<< "'s PID is " << value << std::endl;}//entering the process namechar* Enter_Process_Name (){std::cout << "enter the process name:/n";fgets(name,LENGTH,stdin);//avoid buffer overflow*strchr(name,'/n') = '/0';return (name);}//gettinig process IDPID_T Get_Id (){PID_T pid = Get_Process_Id_By_Name (Enter_Process_Name());Judge_Right_Return (pid);return (pid);}//show process informationDWORD Show_Memory_Information (PID_T pid){/*HANDLE hprocesshandle = OpenProcess (PROCESS_ALL_ACCESS,FALSE,pid); //get a handle form a value pidDWORD readedbyte;BYTE imemorybuffer[1024];//store the memory informationmemset(imemorybuffer,0,1024);//initlize the memorysize_t i;LPCVOID lbaseaddress;*/HANDLE hprocesshandle = OpenProcess (PROCESS_VM_READ,FALSE,pid); //get a handle form a value pidif (hprocesshandle == INVALID_HANDLE_VALUE)return (FALSE);DWORD readedbyte;memset(imemorybuffer,0,1024);//initlize the memorysize_t i,j;//the loop variable//////////////////////*MEMORY_BASIC_INFORMATION mbi;//memory information PBYTE pAddress = NULL;VirtualQueryEx(hprocesshandle,(LPCVOID)(0x0012ff78),&mbi,sizeof(mbi));//if the memory can't receive all byte,return false*///printf("bass_address is 0x00%x./n",mbi.BaseAddress);//////////////////////////////////////第一种修改/*HANDLE h= CreateToolhelp32Snapshot(TH32CS_SNAPMODULE, pid); MODULEENTRY32 me; int red = Module32First(h, &me);while (red){printf("bass_address is 0x00%x./n",me.modBaseAddr);printf("module name is %s/n",me.szModule);//MODULEINFO modinfo;//GetModuleInformation(hprocesshandle,me.hModule,&modinfo,sizeof(modinfo));//printf("bass_address is 0x00%x./n",modinfo.EntryPoint);//printf("bass_address is 0x00%x./n",modinfo.lpBaseOfDll);red = Module32Next(h, &me);}*///////////////////////////////////MODULE mod;if (!ReadProcessMemory(hprocesshandle,(LPCVOID)(0x0012ff3c),imemorybuffer,48,&readedbyte)){std :: cout << "fail to read memory information!!!/n";return (FALSE);}std :: cout << "the memory information is : /n";for (i = 0; i < readedbyte; i++){if ((i%12) == 0 )putchar (10);printf("%4d",imemorybuffer[i]) ;//print the memory date}for (i = 0,j = 0; j < readedbyte; i += 4,j += 12){Int_To_binary(imemorybuffer+j,4,i/4);std::cout << std ::endl << "integer"<< i/4+1<< "is " << Get_Int_From_Binary(i/4) << std::endl;}CloseHandle (hprocesshandle);putchar(10);return (TRUE);}//the function of bit manipulation to a BYTE int Byte_To_Binary(BYTE num,int position,int j)//j stands what's the number{int i = position;//the limit length of the binary numberwhile (position - 8 != i){str[j][i] = (num & 01) + '0';num >>= 1;i--;}return (i);}//the function of bit manipulation to type bool Int_To_binary (BYTE* num,int size,int j){int position = LEN - 1;int i;for ( i = 0; i < size; i++ )position = Byte_To_Binary(*(num+i),position,j);if (i == size)return (true);else return (false);}//the function of getting a integer form a binaryint Get_Int_From_Binary(int j){int integer;int i;for (integer = 0,i = 0; i != LEN; ++i)if ( 49 == str[j][i] )integer += right[LEN-1-i] ;return (integer);}/////////////////////////////////////////////////////////////////////main_driver_process.h#include "process.h"#include <iostream>int main (void){PID_T pid = Get_Id ();//calling the function of getting IDShow_Memory_Information (pid);//calling the function of showing the process memory informationreturn 0;}