c++读写内存（C++ reads and writes memory）.docVIP

c++读写内存（C++ reads and writes memory） I have seen such an article Do not know you have no use I told you this problem is much more interested in But if the direct reading words of memory You can write WDM You can also enter the ring0 You take a look at this article This is a reprint of the statement: Api interception is not a new technology, many commercial software are using this technology. The Api function of windows interception, nothing more than two kinds of methods, the first is the Mr. Jeffrey Richter module import section, modify EXE file method, very safe, but is very complex, and some exe files, no list of input symbols Dll, there may be less than the intercept. Second method is commonly used in JMP XXX, although very old, but it is very simple and practical. This paper introduces second methods of using Win2k in the. Second methods, Win98/me as many ways into the Ring0 level of LDT, IDT, Vxd and other methods, it is easy to dynamically modify the code in memory, but in Win2k, these methods can be used to write WDM is too complex, on the surface, it seems very difficult to achieve, In fact. Win2k provides a powerful memory Api operation function of ---VirtualProtectEx, we WriteProcessMemeory, ReadProcessMemeory, and with them we can modify the code in the dynamic memory, the prototype for the: BOOL (VirtualProtectEx HANDLE hProcess, / / process handle to modify memory LPVOID lpAddress / / start address to modify memory DWORD dwSize / / modify the bytes of memory DWORD flNewProtect / / memory modified properties PDWORD lpflOldProtect / / modify the memory address of the property ); BOOL (WriteProcessMemory HANDLE hProcess, / / handle to write process LPVOID lpBaseAddress / / start address memory write LPVOID lpBuffer, / / write data. DWORD nSize, / / the number of bytes to write LPDWORD lpNumberOfBytesWritten / / the actual writing of sub section number ); BOOL (ReadProcessMemory HANDLE hProcess, / / handle to read process LPCVOID lpBaseAddress / / start ad