问题描述：想通过基址加偏移后的地址读取其中的数据，网上的方法是：
int sun; // 用于存放阳光数据
LPCVOID mbase = (LPCVOID)0x006A9EC0; // [[[006A9EC0]+768]+5560] = sun
LPVOID mbuffer = (LPVOID)&sun;
::ReadProcessMemory(processh, mbase, mbuffer, 4, 0);
mbase = (LPCVOID)(sun + 0x768);
::ReadProcessMemory(processh, mbase, mbuffer, 4, 0);
mbase = (LPCVOID)(sun + 0x5560);
::ReadProcessMemory(processh, mbase, mbuffer, 4, 0);
printf("您有阳光:%d\n", sun);
现在想抽成一个函数结果不行：
processh:进程句柄；
rAddress：想返回多次偏移后的此次的地址；
base：基地址；
ofst：偏移字符串：
HANDLE mProcess = NULL;
DWORD lpExitCode;
HWND hwnd = NULL;
DWORD dwProcessId = NULL;
DWORD offst[1] = {0x768，0x768};
int len_offst = (sizeof(offst) / sizeof(offst[0]));
int lock_time; // 用于存放锁屏数据
LPCVOID realAddress;//偏移后的地址；
LPCVOID mbase = (LPCVOID)0x006A9EC0; // [[[006A9EC0]+768]+768] = sun
LPVOID mbuffer = (LPVOID)&lock_time;
void getAddress(HANDLE processh, LPCVOID rAddress,LPCVOID base,DWORD ofst[]) {
int len = len_offst;
printf("len:%d\n", len);
for (int i = 0; len; i++) {
cout << ofst[i] << endl;
::ReadProcessMemory(processh, base, mbuffer, 4, 0);
base =(LPCVOID)(lock_time+ofst[i]);
}
rAddress = (LPCVOID)base;
::ReadProcessMemory(processh, base, mbuffer, 4, 0);
printf("锁定时间是:%d\n", mbuffer);
}
函数调用方式：
getAddress(mProcess, realAddress, mbase, offst);
调用后显示的结果与CE查看的实际内存的结果不一致；
[培训]《安卓高级研修班(网课)》月薪三万计划，掌握调试、分析还原ollvm、vmp的方法，定制art虚拟机自动化脱壳的方法
