public IntPtr GetAdderssBySearchCode(byte[] searchCode, int ignore,
AllocationProtectEnum allocationProtect,
AllocationProtectEnum protect,
StateEnum state,
TypeEnum type)
{
IntPtr result = IntPtr.Zero;
if (process == null || process.Id == 0)
{
return(IntPtr.Zero);
}
if (processHandle == IntPtr.Zero)
{
SetProcessHandle();
}
if (processHandle == IntPtr.Zero)
{
return(IntPtr.Zero);
}
IntPtr address = IntPtr.Zero;
Int64 RegionSizeLast = 0;
int RegionSizeRepeatCount = 0;
do
{
MEMORY_BASIC_INFORMATION m;
VirtualQueryEx(processHandle, address, out m, (uint)Marshal.SizeOf(typeof(MEMORY_BASIC_INFORMATION)));
if ((m.AllocationProtect == allocationProtect) &&
(m.Protect == protect) &&
(m.State == state) &&
(m.Type == type))
{
int maxBufferSize = 1024 * 500;//500M
long memSearchIndex = 0;
do
{
int bufferSize = maxBufferSize;
if (maxBufferSize + memSearchIndex > m.RegionSize.ToInt64())
{
bufferSize = (int)(m.RegionSize.ToInt64() - memSearchIndex);
}
byte[] buffer = new byte[bufferSize];
int byteRead = 0;
ReadProcessMemory(processHandle, (IntPtr)(address.ToInt64() + memSearchIndex), buffer, buffer.Length, ref byteRead);
int locate = Locate(buffer, searchCode, ignore);
if (locate != -1)
{
result = (IntPtr)(address.ToInt64() + memSearchIndex) + locate;
}
memSearchIndex += maxBufferSize;
memSearchIndex -= searchCode.Length;
} while (memSearchIndex + searchCode.Length < m.RegionSize.ToInt64() && result == IntPtr.Zero);
}
address = (IntPtr)(address.ToInt64() + m.RegionSize.ToInt64());
if (m.RegionSize.ToInt64() == RegionSizeLast)// 修复win7 maxAddress=0x7ffffffffff的问题
{
RegionSizeRepeatCount++;
}
else
{
RegionSizeRepeatCount = 0;
RegionSizeLast = m.RegionSize.ToInt64();
}
if (RegionSizeRepeatCount >= 100)
{
AutoSave.form1.SetTextBox1Value("RegionSizeRepeatCount大于100");
}
} while (address.ToInt64() < maxAddress.ToInt64() && result == IntPtr.Zero && RegionSizeRepeatCount < 100);
return(result);
}
public static extern bool VirtualProtectEx(IntPtr hProcess, IntPtr lpAddress, UIntPtr dwSize, AllocationProtectEnum flNewProtect, out AllocationProtectEnum lpflOldProtect);
static extern bool VirtualProtectEx(void *hProcess, int lpAddress, uint dwSize, uint flNewProtect, out AllocationProtectEnum lpflOldProtect);
