Private Type PROCESS_INFORMATION '该结构用于容纳新进程的进程和线程标识符
    hProcess As Long
    hThread As Long
    dwProcessId As Long
    dwThreadId As Long
End Type

Private Type STARTUPINFO 'STARTUPINFO结构，其中包含了创建进程时使用的附加信息
    cb As Long
    lpReserved As String
    lpDesktop As String
    lpTitle As String
    dwX As Long
    dwY As Long
    dwXSize As Long
    dwYSize As Long
    dwXCountChars As Long
    dwYCountChars As Long
    dwFillAttribute As Long
    dwFlags As Long
    wShowWindow As Integer
    cbReserved2 As Integer
    lpReserved2 As Byte
    hStdInput As Long
    hStdOutput As Long
    hStdError As Long
End Type
Dim hreedID As Long
Dim Process As Long
Dim pinfo As PROCESS_INFORMATION
Dim zhuangt As Long

Private Type SECURITY_ATTRIBUTES '该参数定义了进程的安全特性
    nLength As Long
    lpSecurityDescriptor As Long
    bInheritHandle As Long
End Type
Private Declare Function CreateProcess Lib "kernel32" Alias "CreateProcessA" (ByVal lpApplicationName As String, ByVal lpCommandLine As String, lpProcessAttributes As SECURITY_ATTRIBUTES, lpThreadAttributes As SECURITY_ATTRIBUTES, ByVal bInheritHandles As Long, ByVal dwCreationFlags As Long, lpEnvironment As Any, ByVal lpCurrentDriectory As String, lpStartupInfo As STARTUPINFO, lpProcessInformation As PROCESS_INFORMATION) As Long
'创建一个新进程 (比如执行一个程序)
Private Declare Function ReadProcessMemory Lib "kernel32" (ByVal hProcess As Long, lpBaseAddress As Any, lpBuffer As Any, ByVal nSize As Long, lpNumberOfBytesWritten As Long) As Long
'读取内存指定位置数据

Private Declare Function CloseHandle Lib "kernel32" (ByVal hObject As Long) As Long
' 关闭一个内核对象。
Private Declare Function ResumeThread Lib "kernel32" _
(ByVal hThread As Long) As Long '恢复执行用SuspendThread挂起的一个线程

Private Declare Function SuspendThread Lib "kernel32" (ByVal hThread As Long) As Long
'将指定线程的执行挂起
Private Declare Sub Sleep Lib "kernel32" (ByVal dwMilliseconds As Long)
'sleep(1000) ''''延迟1秒

Private Declare Function WriteProcessMemory Lib "kernel32" (ByVal hProcess As Long, lpBaseAddress As Any, lpBuffer As Any, ByVal nSize As Long, lpNumberOfBytesWritten As Long) As Long
'写入指定数据到内存指定位置
Private Declare Function TerminateProcess Lib "kernel32" (ByVal hProcess As Long, ByVal uExitCode As Long) As Long
'结束程序。

Private Sub Command1_Click()

On Error GoTo example
CommonDialog1.Filter = "*.exe|*.exe|*.dll|*.dll"
CommonDialog1.Flags = 4100 '只允许输入有效的路径,并去掉"以只读方式打开"
CommonDialog1.ShowOpen
Text1.Text = CommonDialog1.FileName
If CommonDialog1.FileName = "" Then

MsgBox "文件都不选 !!!!!", 64
End
End If

example:

End Sub

Private Sub Command10_Click()
If pinfo.hProcess <> 0 Then
TerminateProcess pinfo.hProcess, 0
pinfo.hProcess = 0
zhuangt = 0

End If
End Sub

Private Sub Command2_Click()
Dim OK As Long
Dim pclass As Long
Dim sinfo As STARTUPINFO
   ' sinfo.cb = Len(sinfo)
     'sinfo.dwFlags = STARTF_USESHOWWINDOW
    'sinfo.wShowWindow = start_size
     
    ' sinfo.wShowWindow = SW_HIDE
    ' sinfo.dwFlags = STARTF_USESHOWWINDOW
     
    Dim sec1 As SECURITY_ATTRIBUTES
    Dim sec2 As SECURITY_ATTRIBUTES
   
If Text1.Text <> "" Then
If hreedID = 0 Then
OK = CreateProcess(vbNullString, Text1.Text, sec1, sec2, False, &H4, 0&, Left$(CommonDialog1.FileName, Len(CommonDialog1.FileName) - Len(CommonDialog1.FileTitle)), sinfo, pinfo)
zhuangt = 1 '状态挂起
End If
End If
End Sub

Private Sub Command3_Click()
If pinfo.hThread <> 0 Then

ResumeThread pinfo.hThread
zhuangt = 2 '状态挂起
End If
End Sub

Private Sub Command4_Click()
If pinfo.hThread <> 0 Then

SuspendThread pinfo.hThread
zhuangt = 1 '状态激活
End If
End Sub

Private Sub Command5_Click()
If zhuangt <> 0 Then
Dim a As Long
Dim b As Long
Dim c As Long
Dim d As Boolean
Dim e As Long
Dim f As Long
b = Text2.Text
e = 0
f = Text3.Text
a = pinfo.hProcess
d = ReadProcessMemory(a, ByVal b, ByVal VarPtr(c), f, e)

If d = False Then
Text4.Text = "读取不成功"
End If

Text4.Text = c
End If
End Sub

Private Sub Command6_Click()
If zhuangt <> 0 Then
Dim cc As Long
Dim a As Long
Dim b As Long
Dim c As Long
Dim d As Boolean
Dim e As Long
Dim f As Long
b = Text5.Text
e = 0
a = pinfo.hProcess
c = Text7.Text
f = Text6.Text

d = WriteProcessMemory(a, ByVal b, c, f, e)

If d = True Then
Text7.Text = "成功写入"
End If
End If
End Sub

Private Sub Command7_Click()
If zhuangt <> 0 Then
Dim shp As Long
shp = Text8.Text
If pinfo.hThread <> 0 Then

ResumeThread pinfo.hThread
Sleep (shp)
SuspendThread pinfo.hThread
zhuangt = 1 '状态挂起
End If
End If
End Sub

Private Sub Command8_Click()
If zhuangt <> 0 Then
Dim sp As Long
Dim zds As Long

Dim a As Long
Dim b As Long
Dim c As Long
Dim d As Boolean
Dim e As Long
Dim f As Long
b = Text2.Text
e = 0
f = Text3.Text
a = pinfo.hProcess
zds = Text10.Text
sp = Text9.Text
OK:

ResumeThread pinfo.hThread
Sleep (sp)
SuspendThread pinfo.hThread

d = ReadProcessMemory(a, ByVal b, ByVal VarPtr(c), f, e)
If d = False Then
Text4.Text = "读取不成功"

End If
End If
Text4.Text = c
If c <> zds Then

GoTo OK
zhuangt = 1 '状态挂起
End If

End Sub

Private Sub Form_Load()
zhuangt = 0

End Sub

Private Sub Timer1_Timer()
If zhuangt = 0 Then
Text11.Text = "还没有程序运行....."
ElseIf zhuangt = 1 Then
Text11.Text = "程序被挂起。。。。"
ElseIf zhuangt = 2 Then
Text11.Text = "程序以激活。。。。"
End If

End Sub

Private Sub Command9_Click()
Dim zh As Long
Dim tt As String
If Text12.Text <> "" Then
tt = "&H" & Text12.Text
zh = tt
Text13.Text = zh
End If
End Sub

不知道为什么这个程序打开的无法访问网络 ,不知道那位高人知道为什么. 指点下小菜...

[招生]科锐逆向工程师培训(2024年11月15日实地，远程教学同时开班, 第51期)