-
-
[求助][讨论]Delphi 关于自定义函数写内存的问题
-
发表于: 2011-10-3 00:21 3060
-
要写个补丁,用WriteProcessMemory方法已经实现完了,现在学习用HOOK后做补丁的实现方法,在这里自己构造了个函数,在这方面出了问题,请大牛们指点一下:
自定义了一个函数,在写内存的时候发现在调用一次的时候写入地址数据正常,当调用第二次的时候在隔四个字节的地方加上b8 25 95 00这样的字节,不明白为什么,请帮助解答一下,代码如下:
function WriteMemory(address:Integer;Bname:array of byte):Boolean;
var
i:Integer;
pData:array of ^Integer;
dwOldProtect: DWORD;
mbi_thunk:TMemoryBasicInformation;
begin
SetLength(pData,SizeOf(Bname));//有的地方说传入的参数不能是静态数组,我两种方式都试过了,也可以呀
for i:=0 to SizeOf(Bname)do
begin
pData[i]:=Pointer(address+i);//将地址传入指针数组
// VirtualQuery(pdata[i], mbi_thunk, sizeof(MEMORY_BASIC_INFORMATION));
end;
//改变页保护属性为读写,用网上学来的方法不变加上了,mbi_thunk.baseaddress也用了pdata的起使地址试了,大小也两种都试了,都一样。
VirtualProtect(mbi_thunk.BaseAddress, mbi_thunk.RegionSize,PAGE_READWRITE, mbi_thunk.Protect);
for i:=0 to SizeOf(Bname)-1 do
begin
PByte(pdata[i])^:=bname[i]; //修改指定地址为传入的数组内容。
end;
VirtualProtect(mbi_thunk.BaseAddress, mbi_thunk.RegionSize,mbi_thunk.Protect, dwOldProtect);
Result :=True;
end;
调用代码如下:
procedure TForm1.Button2Click(Sender: TObject);
const
temp : array[0..1] of byte = ($34,$35);
temp1 : array[0..1] of byte = ($34,$35);
begin
WriteMemory($00450cf8,killb);
WriteMemory($00450cfe,killc); //当这里为一次writememort调用的时候发现正常,两次的时候在00450d04的地址上就加上了b8 25 95 00 不明白是为什么。
end;
------------------------------
以下是全部代码:
unit Unit1;
interface
uses
Windows, Messages, SysUtils, Variants, Classes, Graphics, Controls, Forms,
Dialogs, bsSkinCtrls, bsSkinData, BusinessSkinForm, StdCtrls;
type
TForm1 = class(TForm)
Button1: TButton;
Button2: TButton;
procedure Button1Click(Sender: TObject);
procedure Button2Click(Sender: TObject);
private
{ Private declarations }
public
{ Public declarations }
end;
var
Form1: TForm1;
implementation
{$R *.dfm}
function WriteMemory(address:Integer;Bname:array of byte):Boolean;
var
i:Integer;
pData:array of ^Integer;
dwOldProtect: DWORD;
mbi_thunk:TMemoryBasicInformation;
begin
SetLength(pData,SizeOf(Bname));
for i:=0 to SizeOf(Bname)do
begin
pData[i]:=Pointer(address+i);
// VirtualQuery(pdata[i], mbi_thunk, sizeof(MEMORY_BASIC_INFORMATION));
end;
//改变页保护属性为读写
VirtualProtect(mbi_thunk.BaseAddress, mbi_thunk.RegionSize,PAGE_READWRITE, mbi_thunk.Protect);
//VirtualProtect(pdata[i], mbi_thunk.RegionSize,PAGE_READWRITE, mbi_thunk.AllocationBase);
for i:=0 to SizeOf(Bname)-1 do
begin
PByte(pdata[i])^:=bname[i]; //修改指定地址为XX
end;
VirtualProtect(mbi_thunk.BaseAddress, mbi_thunk.RegionSize,mbi_thunk.Protect, dwOldProtect);
Result :=True;
end;
procedure TForm1.Button1Click(Sender: TObject);
begin
end;
procedure TForm1.Button2Click(Sender: TObject);
const
temp : array[0..1] of byte = ($34,$35);
temp1 : array[0..1] of byte = ($34,$35);
begin
WriteMemory($00450cf8,temp);
WriteMemory($00450cfe,temp1);
end;
end.
-------------------------------------
经查资料发现,在uses里引用sharemem后再运行时写入的就正常了,但是关闭时会出错,在PRG单元里也加上sharemem后半闭不出错了,但是写入就又不正常了,这是什么问题呢?是我查内存保护,改变内存保护的代码部分有问题?还是其它地方有问题?
自定义了一个函数,在写内存的时候发现在调用一次的时候写入地址数据正常,当调用第二次的时候在隔四个字节的地方加上b8 25 95 00这样的字节,不明白为什么,请帮助解答一下,代码如下:
function WriteMemory(address:Integer;Bname:array of byte):Boolean;
var
i:Integer;
pData:array of ^Integer;
dwOldProtect: DWORD;
mbi_thunk:TMemoryBasicInformation;
begin
SetLength(pData,SizeOf(Bname));//有的地方说传入的参数不能是静态数组,我两种方式都试过了,也可以呀
for i:=0 to SizeOf(Bname)do
begin
pData[i]:=Pointer(address+i);//将地址传入指针数组
// VirtualQuery(pdata[i], mbi_thunk, sizeof(MEMORY_BASIC_INFORMATION));
end;
//改变页保护属性为读写,用网上学来的方法不变加上了,mbi_thunk.baseaddress也用了pdata的起使地址试了,大小也两种都试了,都一样。
VirtualProtect(mbi_thunk.BaseAddress, mbi_thunk.RegionSize,PAGE_READWRITE, mbi_thunk.Protect);
for i:=0 to SizeOf(Bname)-1 do
begin
PByte(pdata[i])^:=bname[i]; //修改指定地址为传入的数组内容。
end;
VirtualProtect(mbi_thunk.BaseAddress, mbi_thunk.RegionSize,mbi_thunk.Protect, dwOldProtect);
Result :=True;
end;
调用代码如下:
procedure TForm1.Button2Click(Sender: TObject);
const
temp : array[0..1] of byte = ($34,$35);
temp1 : array[0..1] of byte = ($34,$35);
begin
WriteMemory($00450cf8,killb);
WriteMemory($00450cfe,killc); //当这里为一次writememort调用的时候发现正常,两次的时候在00450d04的地址上就加上了b8 25 95 00 不明白是为什么。
end;
------------------------------
以下是全部代码:
unit Unit1;
interface
uses
Windows, Messages, SysUtils, Variants, Classes, Graphics, Controls, Forms,
Dialogs, bsSkinCtrls, bsSkinData, BusinessSkinForm, StdCtrls;
type
TForm1 = class(TForm)
Button1: TButton;
Button2: TButton;
procedure Button1Click(Sender: TObject);
procedure Button2Click(Sender: TObject);
private
{ Private declarations }
public
{ Public declarations }
end;
var
Form1: TForm1;
implementation
{$R *.dfm}
function WriteMemory(address:Integer;Bname:array of byte):Boolean;
var
i:Integer;
pData:array of ^Integer;
dwOldProtect: DWORD;
mbi_thunk:TMemoryBasicInformation;
begin
SetLength(pData,SizeOf(Bname));
for i:=0 to SizeOf(Bname)do
begin
pData[i]:=Pointer(address+i);
// VirtualQuery(pdata[i], mbi_thunk, sizeof(MEMORY_BASIC_INFORMATION));
end;
//改变页保护属性为读写
VirtualProtect(mbi_thunk.BaseAddress, mbi_thunk.RegionSize,PAGE_READWRITE, mbi_thunk.Protect);
//VirtualProtect(pdata[i], mbi_thunk.RegionSize,PAGE_READWRITE, mbi_thunk.AllocationBase);
for i:=0 to SizeOf(Bname)-1 do
begin
PByte(pdata[i])^:=bname[i]; //修改指定地址为XX
end;
VirtualProtect(mbi_thunk.BaseAddress, mbi_thunk.RegionSize,mbi_thunk.Protect, dwOldProtect);
Result :=True;
end;
procedure TForm1.Button1Click(Sender: TObject);
begin
end;
procedure TForm1.Button2Click(Sender: TObject);
const
temp : array[0..1] of byte = ($34,$35);
temp1 : array[0..1] of byte = ($34,$35);
begin
WriteMemory($00450cf8,temp);
WriteMemory($00450cfe,temp1);
end;
end.
-------------------------------------
经查资料发现,在uses里引用sharemem后再运行时写入的就正常了,但是关闭时会出错,在PRG单元里也加上sharemem后半闭不出错了,但是写入就又不正常了,这是什么问题呢?是我查内存保护,改变内存保护的代码部分有问题?还是其它地方有问题?
[注意]传递专业知识、拓宽行业人脉——看雪讲师团队等你加入!
赞赏
他的文章
看原图
赞赏
雪币:
留言: