1、#include #include #include BOOL FindFirst(DWORD dwVilue);BOOL FindNext(DWORD dwVilue);DWORD g_arList1024;int g_nListCnt;HANDLE g_hProcess;BOOL CompareAPage(DWORD dwBaseAddr,DWORD dwValue) /allot memory to sava bufferedwordsBYTE arBytes4096;/return bool,the size of a page is 4kb,the last one is retur

2、n valueif(上:ReadProcessMemory(g_hProcess,(LPVOID)dwBaseAddr,arBytes,4096,NULL) return FALSE;DWORD* pdw;for(int i=0;i=1024)return FALSE;將地址送入地址數(shù)組g_arListg_nListCnt+=dwBaseAddr+i;return TRUE;void ShowList()for(int i=0;i1)printf(Input val=);scanf(”d”,&iVil);/search the nextFindNext(iVal);/display the r

3、esultsShowList();printf(New value=);scanf(”d”,&iVil);if(WriteMemory(g_arList0,iVhl)printf(Write data successn);:CloseHandle(g_hProcess);return 0;BOOL FindFirst(DWORD dwVilue)const DWORD dwOneGB=1024*1024*1024;const DWORD dwOnePage=4*1024;if(g_hProcess=NULL)return FALSE;DWORD dwBase;OSVERSIONINFO vi=

4、sizeof(vi);:GetVersionEx(&vi);if(vi.dwPlatformId=VER_PLATFORM_WIN32_WINDOWS)dwBase=4*1024*1024;elsedwBase=640*1024;for(;dwBase2*dwOneGB;dwBase+=dwOnePage)CompareAPage(dwBase,dwValue);return TRUE;BOOL FindNext(DWORD dwValue) /save the number of the effective addressesof ARRAY m_arList,initializethe n

5、ew value of m_arListint nOrgCnt=g_nListCnt;g_nListCnt=0;/find according the address of ARRAYm_arListBOOL bRet=FALSE;DWORD dwReadValue;for(int i=0;inOrgCnt;i+)if(:ReadProcessMemory(g_hProcess,(LPVOID)g_arListi,&dwReadVilue,sizeof(DWORD) ,NULL)if(dwReadValue=dwValue)g_arListg_nListCnt+=g_arListi;bRet=

6、TRUE;for(int i=g_nListCnt;inOrgCnt;i+)g_arListi=0;return bRet;程序開始聲明了 2個后面的函數(shù)，另外還有3個GLOBAL變量一個是作為地址列表的，另一個是存放地址個數(shù)的，最后一個是句柄。Winsows采用的是4KB為一頁的內(nèi)存管理機(jī)制，為提高搜索目標(biāo)的效率先在一頁中（即4KB） 搜索。函數(shù)COMPAREAPAGE （DWORD，DWORD）就是實(shí)現(xiàn)此功能的。此函數(shù)用了 READPROCESSMEMORY（DWORD，DWORD），來讀取一頁中的數(shù)據(jù)，并返 回布爾值。將讀取的數(shù)據(jù)送到緩沖區(qū)數(shù)組中，對緩沖區(qū)進(jìn)行遍歷搜索，每次搜索4個字節(jié)（即 一個DWORD型數(shù)據(jù)），總共搜索4*1024-3次，如果有，則將地