最近 遇到了一个非常让人困惑的问题，或者说难题吧
一般在XP下 WriteProcessMemory 只要先提权进程权限 获得进程ID然后NTOpenprocess打开进程获得 句柄 virtualqueryEx获得内存信息 VirtualProtectEx 处理下进程中内存区域的保护属性 接着WriteProcessMemory 写入内存最后VirtualProtectEx处理下进程中内存区域的保护属性 即可，但是 貌似这个方法在WIN7下用驱动操作都比较难，本来以为上驱动了么 直接按照这个思路就可以，但是不好意思，我用了 好几种编程语言都失败了，先是封装好的易模块，因为图简单，结果每次都失败了 蓝了很多次，接着用了VC还是失败了，最后我觉得自己 快不行了 ，每天都接受着煎熬，然后 把CE 5.6的代码看了下，逐步的调试 结果发现问题在NTOpenprocess返回的句柄权限不够，然后上CE论坛问了下Dark Byte提示
OpenProces, VirtualQueryEx and Read/WriteProcessMemory are pointers to a function.
Newkernelhandler.pas decides where those pointers point to.
When using kernelmode openprocess, the OpenProcess call will go to the OpenProcess function implemented in dbk32functions.pas (in 5.x that's in dbk32.dll)
That function tells the dbk32.sys driver to obtain a handle to the process and return it to usermode.
If it fails to get a valid handle, dbk32functions will create a shadow handle that is only valid for the functions of dbk32 itself. (It's used to know the EProcess address of the process opened)
看来 我要写入到其他被NTOpenprocess HOOK的进程需要换个方式了 求大牛指点
下面是部分的代码，希望 有大牛出没。（提升权限 和获得进程ID就不写了 因为都没问题，需要的话我后面发）
procedure TForm1.btn1Click(Sender: TObject);
var
DllVersion : String;
begin
UseDBKOpenProcess;// LoadDBK32;
UseDBKReadWriteMemory; // DBKReadWrite:=true;
pid:=GetProcessID( 'war3.exe');
if pid<>0 then
begin
lbl1.Caption:='pid'+inttostr(pid);
end;
game_dll_BaseAddr:=BEnumProcesses(pid,'Game.dll');
if GetAppVersion(DllfullName)<>'' then
begin
DllVersion:=GetAppVersion(DllfullName);
end;
lbl4.Caption:=DllVersion;
if DllVersion='1.24.4.6387'then
begin
hProcess := OpenProcess(PROCESS_ALL_ACCESS,false,pid);//
lbl2.Caption:='hprocess'+inttostr(hProcess);
if hProcess <> 0 then
begin
patch($356D9C, 3677601843,4);
CloseHandle(hProcess);
end;
end;
procedure Patch(Address: Integer; Value, Size: Integer);
begin
WriteMemory(address + game_dll_BaseAddr,Value ,size );
end;
procedure WriteMemory(Address: Integer; intValue, size: Integer);
var
buffer : ^Integer;
null : THandle;
original,oldPro : integer;
mbi: TMemoryBasicInformation;
begin
New(buffer);
buffer^ := intValue;
if hprocess<>0 then
begin
queryaddr:=virtualqueryEx(hProcess,pointer(address),mbi,sizeof(mbi));//just watch MemoryBasicInformation;
memgetsucess:=VirtualProtectEx( hProcess,Pointer(Address),size, PAGE_EXECUTE_READWRITE,integer(mbi.Protect));// return false if NTopenprocess has been HOOK(r0) windows 7 (win32)
sucess:=WriteProcessMemory(hprocess,Pointer(Address), buffer ,size , null);//
memsetsucess:=VirtualProtectEx( hProcess,Pointer(Address),size, integer(mbi.Protect),original); //
end;
if queryaddr=sizeof(mbi) then
begin
querysuc:=True;
end else
begin
querysuc:=false;
end;
Dispose(buffer);
end;
