首页
社区
课程
招聘
[求助]内存占用
发表于: 2007-12-21 20:59 4198

[求助]内存占用

2007-12-21 20:59
4198
我想用delphi的Timer控件写一个定时程序,用来查找不同进程中是否含有指定的模块。但是运行时会出进内存占用不断增加的情况,关闭程序后才释放。
代码写得很烂
procedure TForm1.Timer1Timer(Sender: TObject);
var
    hProcessSnap,hModuleSnap,PHandle:THandle;
    ProcessEntry32:tagProcessEntry32;
    ModuleEntry32:tagModuleEntry32;
    Process32,Module32,sucessful:boolean;
    FileName,DLLname,exename:string;
    BaseAdd2,tt:Cardinal;
    url,url1,url2: array [0..42] of char;
    RV:dword;

const
  RVA1:dword= $4a350;
  RvA2:dword= $589e8;
  BaseAdd1:dword=$400000;

begin
  url:='url';
  url1:='url1';

  DLLname:='dllname';
  exename:='exename';
  hProcessSnap:=CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
  ProcessEntry32.dwSize:=sizeof(ProcessEntry32);
  Process32:=Process32First(hProcessSnap, ProcessEntry32);
  while  Process32 do
  begin
    hModuleSnap:=CreateToolhelp32Snapshot(TH32CS_SNAPMODULE, ProcessEntry32.th32ProcessID);
    ModuleEntry32.dwSize:=sizeof(ModuleEntry32);
    Module32:=Module32First(hModuleSnap, ModuleEntry32);
    while Module32 do
    begin
    FileName:=ExtractFileName(ModuleEntry32.szExePath);
      if FileName=exename then
        begin
          RV:=BaseAdd1+RVA1;
          PHandle:= OpenProcess(PROCESS_ALL_ACCESS, false,ProcessEntry32.th32ProcessID );
          ReadProcessMemory(PHandle,Pointer(RV),@url2,43,tt);
          if url=url2 then
            begin
              sucessful:= WriteProcessMemory(PHandle, Pointer(RV), @url1, sizeof(url1), tt);
              CloseHandle(PHandle);
              if  sucessful then Label2.Caption:='成功'
              else
                Label2.Caption:='失败';
            end;
        end;
      if FileName=dllName then
         begin

            BaseAdd2:=Cardinal(ModuleEntry32.modBaseAddr);
            RV:=BaseAdd2+RVA2;
            PHandle:= OpenProcess(PROCESS_ALL_ACCESS, false,ProcessEntry32.th32ProcessID );
            ReadProcessMemory(PHandle,Pointer(RV),@url2,43,tt);
            if url=url2 then
            begin
              sucessful:= WriteProcessMemory(PHandle, Pointer(RV), @url1, sizeof(url1), tt);
              CloseHandle(PHandle);
              if  sucessful then Label2.Caption:='成功'
              else Label2.Caption:='失败';
            end;
        end;
      Module32:=Module32Next(hModuleSnap, ModuleEntry32);
    end;
    Process32:=Process32Next(hProcessSnap, ProcessEntry32);
  end;
end;

[课程]Linux pwn 探索篇!

收藏
免费 0
支持
分享
最新回复 (3)
雪    币: 200
活跃值: (165)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
2
句柄没有关闭!

建议看看 CreateToolhelp32Snapshot msdn 的说明:
The snapshot taken by this function is examined by the other tool help functions to provide their results. Access to the snapshot is read only. The snapshot handle acts as an object handle and is subject to the same rules regarding which processes and threads it is valid in.

To enumerate the heap or module states for all processes, specify TH32CS_SNAPALL and set th32ProcessID to zero. Then, for each additional process in the snapshot, call CreateToolhelp32Snapshot again, specifying its process identifier and the TH32CS_SNAPHEAPLIST or TH32_SNAPMODULE value.

To destroy the snapshot, use the CloseHandle function.
2007-12-22 00:07
0
雪    币: 210
活跃值: (10)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
3
thank you
2007-12-23 16:29
0
雪    币: 20
活跃值: (37)
能力值: ( LV4,RANK:50 )
在线值:
发帖
回帖
粉丝
4
MS说过他这个东西有bug
你去MSDN看看就知道了
2007-12-24 12:40
0
游客
登录 | 注册 方可回帖
返回
//