如何检索64位指针的内存地址?

本文关键字：指针内存地址 64位何检索检索 | 更新日期: 2023-09-27 18:05:32

我正在开发一款支持32位和64位系统的flash游戏训练器。

我试图返回指针的内存地址，以便我可以使用内存地址来更改值。我能够在32位版本中完美地做到这一点。但是，在64位版本中，它返回一个不正确的内存地址。

培训师目前只支持谷歌浏览器。如果你使用的是32位的训练器，Chrome需要是32位的。如果你使用64位训练器，Chrome需要64位。

这是来自作弊引擎的32位指针信息:

<?xml version="1.0" encoding="utf-8"?>
<CheatTable>
  <CheatEntries>
    <CheatEntry>
      <ID>0</ID>
      <Description>"pointerscan result"</Description>
      <LastState Value="10000" RealAddress="071DCAA8"/>
      <VariableType>4 Bytes</VariableType>
      <Address>"pepflashplayer.dll"+01035A80</Address>
      <Offsets>
        <Offset>28</Offset>
        <Offset>28</Offset>
        <Offset>464</Offset>
        <Offset>B8</Offset>
        <Offset>80</Offset>
      </Offsets>
    </CheatEntry>
  </CheatEntries>
</CheatTable>

下面的代码将成功检索32位指针的内存地址:

using System;
using System.Diagnostics;
using System.Linq;
using System.Runtime.InteropServices;
namespace Trainer
{
    internal class Program
    {
        [DllImport("kernel32.dll", SetLastError = true)]
        private static extern bool ReadProcessMemory(IntPtr process, IntPtr baseAddress, [Out] byte[] buffer, int size,
            out IntPtr bytesRead);
        public static int ReadInt32(IntPtr process, IntPtr baseAddress)
        {
            var buffer = new byte[4];
            IntPtr bytesRead;
            ReadProcessMemory(process, baseAddress, buffer, 4, out bytesRead);
            return BitConverter.ToInt32(buffer, 0);
        }
        private static ProcessModule GetProcessModule(Process process, string moduleName)
        {
            foreach (ProcessModule module in process.Modules)
            {
                if (module.ModuleName == moduleName)
                {
                    return module;
                }
            }
            return null;
        }
        public static int GetRealAddress(IntPtr process, IntPtr baseAddress, int[] offsets)
        {
            var address = baseAddress.ToInt32();
            foreach (var offset in offsets)
            {
                address = ReadInt32(process, (IntPtr)address) + offset;
            }
            return address;
        }
        private static void Main()
        {
            Console.WriteLine(Environment.Is64BitProcess);
            // Get the first Chrome process that contains a module named "pepflashplayer.dll".
            var chromeProcess =
                Process.GetProcessesByName("chrome")
                    .FirstOrDefault(
                        process =>
                            process.Modules.Cast<ProcessModule>()
                                .Any(module => module.ModuleName == "pepflashplayer.dll"));
            if (chromeProcess != null)
            {
                var flashPlayerModule = GetProcessModule(chromeProcess, "pepflashplayer.dll");
                var baseAddress = flashPlayerModule.BaseAddress.ToInt32() + 0x01035A80;
                var offsets = new[] { 0x80, 0xB8, 0x464, 0x28, 0x28 };
                var realAddress = GetRealAddress(chromeProcess.Handle, (IntPtr)baseAddress, offsets);
                Console.WriteLine(realAddress.ToString("X"));
                Console.ReadLine();
            }
        }
    }
}

输出:

假83 caaa8

这是来自作弊引擎的64位指针信息:

<?xml version="1.0" encoding="utf-8"?>
<CheatTable>
  <CheatEntries>
    <CheatEntry>
      <ID>0</ID>
      <Description>"pointerscan result"</Description>
      <LastState Value="10000" RealAddress="2A0C3492B38"/>
      <VariableType>4 Bytes</VariableType>
      <Address>"pepflashplayer.dll"+01CB16E8</Address>
      <Offsets>
        <Offset>48</Offset>
        <Offset>3D8</Offset>
        <Offset>370</Offset>
        <Offset>7A8</Offset>
        <Offset>360</Offset>
      </Offsets>
    </CheatEntry>
  </CheatEntries>
</CheatTable>