DLLname:='dllname';
exename:='exename';
hProcessSnap:=CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
ProcessEntry32.dwSize:=sizeof(ProcessEntry32);
Process32:=Process32First(hProcessSnap, ProcessEntry32);
while Process32 do
begin
hModuleSnap:=CreateToolhelp32Snapshot(TH32CS_SNAPMODULE, ProcessEntry32.th32ProcessID);
ModuleEntry32.dwSize:=sizeof(ModuleEntry32);
Module32:=Module32First(hModuleSnap, ModuleEntry32);
while Module32 do
begin
FileName:=ExtractFileName(ModuleEntry32.szExePath);
if FileName=exename then
begin
RV:=BaseAdd1+RVA1;
PHandle:= OpenProcess(PROCESS_ALL_ACCESS, false,ProcessEntry32.th32ProcessID );
ReadProcessMemory(PHandle,Pointer(RV),@url2,43,tt);
if url=url2 then
begin
sucessful:= WriteProcessMemory(PHandle, Pointer(RV), @url1, sizeof(url1), tt);
CloseHandle(PHandle);
if sucessful then Label2.Caption:='成功'
else
Label2.Caption:='失败';
end;
end;
if FileName=dllName then
begin
BaseAdd2:=Cardinal(ModuleEntry32.modBaseAddr);
RV:=BaseAdd2+RVA2;
PHandle:= OpenProcess(PROCESS_ALL_ACCESS, false,ProcessEntry32.th32ProcessID );
ReadProcessMemory(PHandle,Pointer(RV),@url2,43,tt);
if url=url2 then
begin
sucessful:= WriteProcessMemory(PHandle, Pointer(RV), @url1, sizeof(url1), tt);
CloseHandle(PHandle);
if sucessful then Label2.Caption:='成功'
else Label2.Caption:='失败';
end;
end;
Module32:=Module32Next(hModuleSnap, ModuleEntry32);
end;
Process32:=Process32Next(hProcessSnap, ProcessEntry32);
end;
end;
建议看看 CreateToolhelp32Snapshot msdn 的说明:
The snapshot taken by this function is examined by the other tool help functions to provide their results. Access to the snapshot is read only. The snapshot handle acts as an object handle and is subject to the same rules regarding which processes and threads it is valid in.
To enumerate the heap or module states for all processes, specify TH32CS_SNAPALL and set th32ProcessID to zero. Then, for each additional process in the snapshot, call CreateToolhelp32Snapshot again, specifying its process identifier and the TH32CS_SNAPHEAPLIST or TH32_SNAPMODULE value.
To destroy the snapshot, use the CloseHandle function.