分享C#操作內(nèi)存讀寫方法的主要實(shí)現(xiàn)代碼
using System.Runtime.InteropServices;
using System.Text;
publicclass Function
{
//C#操作內(nèi)存讀寫方法
publicstaticbyte PtrToByte( int Ptr )
{
byte b = Marshal.ReadByte( ( IntPtr ) Ptr );
return b;
}
publicstaticchar PtrToChar( int Ptr )
{
byte b = Marshal.ReadByte( ( IntPtr ) Ptr );
return ( char ) b;
}
publicstaticshort PtrToShort( int Ptr )
{
short b = Marshal.ReadInt16( ( IntPtr ) Ptr );
return b;
}
//C#操作內(nèi)存讀寫方法
publicstaticushort PtrToUShort( int Ptr )
{
ushort b = ( ushort ) Marshal.ReadInt16( ( IntPtr ) Ptr );
return b;
}
publicstaticint PtrToInt( int Ptr )
{
int b = Marshal.ReadInt32( ( IntPtr ) Ptr );
return b;
}
publicstaticuint PtrToUInt( int Ptr )
{
uint b = ( uint ) Marshal.ReadInt32( ( IntPtr ) Ptr );
return b;
}
publicstaticlong PtrToLong( int Ptr )
{
long b = Marshal.ReadInt64( ( IntPtr ) Ptr );
return b;
} //C#操作內(nèi)存讀寫方法
publicstaticulong PtrToULong( int Ptr )
{
ulong b = ( ulong ) Marshal.ReadInt64( ( IntPtr ) Ptr );
return b;
}
// Convert an ip address stored an address to equivalent string value
publicstaticstring GetPtrToIpAddr(int intPtr, int varlen)
{
int i = 0;
StringBuilder sb = new StringBuilder(0,varlen*4);
byte[] byx = newbyte[varlen];
// ip address cann't have zero value C#操作內(nèi)存讀寫方法
// ip address cann't have zero length C#操作內(nèi)存讀寫方法
if( ( intPtr == 0 ) || ( varlen == 0 ) ) return"";
Marshal.Copy( ( IntPtr ) intPtr , byx , 0 , varlen );
for( i = 0; i < varlen - 1; i ++ )
{
sb.Append(byx[i]);
sb.Append('.');
}
sb.Append(byx[varlen - 1]);
return sb.ToString();
}
}
BOOL ReadProcessMemory( HANDLE hProcess, PVOID pvAddressRemote, PVOID pvBufferLocal, DWORD dwSize, PDWORD pdwNumBytesRead);
參數(shù)
hProcess為遠(yuǎn)程進(jìn)程的句柄
pvAddressRemote用于指明遠(yuǎn)程進(jìn)程中的地址
pvBufferLocal是本地進(jìn)程中的內(nèi)存地址
dwSize是需要傳送的字節(jié)數(shù)
pdwNumBytesRead和pdwNumBytesWritten用于指明實(shí)際傳送的字節(jié)數(shù).當(dāng)函數(shù)返回時(shí)，可以查看這兩個(gè)參數(shù)的值.
ReadProcessMemory讀出數(shù)據(jù)，權(quán)限要大一些。下面這個(gè)打開進(jìn)程的方式具備了查詢 讀和寫的權(quán)限
hProcess = OpenProcess(PROCESS_QUERY_INFORMATION Or PROCESS_VM_OPERATION Or PROCESS_VM_READ Or PROCESS_VM_WRITE, 0, ProcessId)
然后就要結(jié)合上面的程序來搜索了。只有當(dāng)內(nèi)存是處于被占用狀態(tài)時(shí)才去讀取其中的內(nèi)容，而忽略空閑狀態(tài)的內(nèi)存。程序我就不在這兒寫了，和上面那段差不多。只是把dwTotalCommit = dwTotalCommit + mi.RegionSize換成了讀取內(nèi)存以及搜索這一塊內(nèi)存的函數(shù)而已。
1.通過FindWindow讀取窗體的句柄
2.通過GetWindowThreadProcessId讀取查找窗體句柄進(jìn)程的PID值
3.用OpenProcess(PROCESS_QUERY_INFORMATION Or PROCESS_VM_OPERATION Or PROCESS_VM_READ Or PROCESS_VM_WRITE, 0, ProcessId)打開查到PID值的進(jìn)程. 此打開具備 讀取,寫入,查詢的權(quán)限
4.ReadProcessMemory讀出指定的內(nèi)存地址數(shù)據(jù)
//C#讀取內(nèi)存例子
using System;
using System.Collections.Generic;
using System.Text;
using System.Runtime.InteropServices;
using System.Diagnostics;
using System.Management;
publicclass key
{
constuint PROCESS_ALL_ACCESS =0x001F0FFF;
constuint KEYEVENTF_EXTENDEDKEY =0x1;
constuint KEYEVENTF_KEYUP =0x2;
privatereadonlyint MOUSEEVENTF_LEFTDOWN =0x2;
privatereadonlyint MOUSEEVENTF_LEFTUP =0x4;
constuint KBC_KEY_CMD =0x64;
constuint KBC_KEY_DATA =0x60;
//得到窗體句柄的函數(shù),FindWindow函數(shù)用來返回符合指定的類名( ClassName )和窗口名( WindowTitle )的窗口句柄
[DllImport("user32.dll", CharSet = CharSet.Auto)]
publicstaticextern IntPtr FindWindow(
string lpClassName, // pointer to class name
string lpWindowName // pointer to window name
);
[DllImport("user32.dll")]
privatestaticexternint GetWindowThreadProcessId(IntPtr id, int pid);
[DllImport("kernel32.dll")]
privatestaticexternvoid CloseHandle
(
uint hObject //Handle to object
);
//讀取進(jìn)程內(nèi)存的函數(shù)
[DllImport("kernel32.dll")]
staticexternbool ReadProcessMemory(uint hProcess, IntPtr lpBaseAddress,
IntPtr lpBuffer, uint nSize, refuint lpNumberOfBytesRead);
//得到目標(biāo)進(jìn)程句柄的函數(shù)
[DllImport("kernel32.dll")]
publicstaticexternuint OpenProcess(uint dwDesiredAccess, bool bInheritHandle, int dwProcessId);
//鼠標(biāo)事件聲明
[DllImport("user32.dll")]
staticexternbool setcursorpos(int x, int y);
[DllImport("user32.dll")]
staticexternvoid mouse_event(mouseeventflag flags, int dx, int dy, uint data, UIntPtr extrainfo);
//鍵盤事件聲明
[DllImport("user32.dll")]
staticexternbyte MapVirtualKey(byte wCode, int wMap);
[DllImport("user32.dll")]
staticexternshort GetKeyState(int nVirtKey);
[DllImport("user32.dll")]
staticexternvoid keybd_event(byte bVk, byte bScan, uint dwFlags, uint dwExtraInfo);
//鍵盤事件聲明winio
[DllImport("winio.dll")]
publicstaticexternbool InitializeWinIo();
[DllImport("winio.dll")]
publicstaticexternbool GetPortVal(IntPtr wPortAddr, outint pdwPortVal, byte bSize);
[DllImport("winio.dll")]
publicstaticexternbool SetPortVal(uint wPortAddr, IntPtr dwPortVal, byte bSize);
[DllImport("winio.dll")]
publicstaticexternbyte MapPhysToLin(byte pbPhysAddr, uint dwPhysSize, IntPtr PhysicalMemoryHandle);
[DllImport("winio.dll")]
publicstaticexternbool UnmapPhysicalMemory(IntPtr PhysicalMemoryHandle, byte pbLinAddr);
[DllImport("winio.dll")]
publicstaticexternbool GetPhysLong(IntPtr pbPhysAddr, byte pdwPhysVal);
[DllImport("winio.dll")]
publicstaticexternbool SetPhysLong(IntPtr pbPhysAddr, byte dwPhysVal);
[DllImport("winio.dll")]
publicstaticexternvoid ShutdownWinIo();
///<summary>
/// 獲取進(jìn)程pid
///</summary>
///<param name="name"></param>
///<returns></returns>
privateint pid(String name)
{
try
{
ObjectQuery oQuery =new ObjectQuery("select * from Win32_Process where Name='"+ name +"'");
ManagementObjectSearcher oSearcher =new ManagementObjectSearcher(oQuery);
ManagementObjectCollection oReturnCollection = oSearcher.Get();
string pid ="";
string cmdLine;
StringBuilder sb =new StringBuilder();
foreach (ManagementObject oReturn in oReturnCollection)
{
pid = oReturn.GetPropertyValue("ProcessId").ToString();
//cmdLine = (string)oReturn.GetPropertyvalue("CommandLine");
//string pattern = "-ap \"(.*)\"";
//Regex regex = new Regex(pattern, RegexOptions.IgnoreCase);
// Match match = regex.Match(cmdLine);
//string appPoolName = match.Groups[1].ToString();
//sb.AppendFormat("W3WP.exe PID: {0} AppPoolId:{1}\r\n", pid, appPoolName);
}
return Convert.ToInt32(pid);
}
catch (Exception ss)
{ return0; }
}
privateint pid(IntPtr id)
{
int pid =0;
pid = GetWindowThreadProcessId(id, pid);
return260;
}
///<summary>
/// 讀取內(nèi)存值
///</summary>
///<param name="name">進(jìn)程id</param>
///<param name="dizhi">讀取的內(nèi)存地址</param>
///<returns></returns>
//public String getread(String QEC,String EC, IntPtr dizhi, uint size)
//{
// Byte bt = new Byte();
// IntPtr id=FindWindow(QEC, EC);
// uint hProcess = OpenProcess(PROCESS_ALL_ACCESS, false, pid(id));
// IntPtr fanhui = new IntPtr();
// String gg = null;
// if (hProcess == 0)
// {
//// gg = ReadProcessMemory(hProcess, dizhi, fanhui, size, 0);
//// CloseHandle(hProcess);
// }
// return gg;
//}
public String getread(String jincheng, String EC, IntPtr dizhi, uint size)
{
byte[] vBuffer =newbyte[4];
IntPtr vBytesAddress = Marshal.UnsafeAddrOfPinnedArrayElement(vBuffer, 0); // 得到緩沖區(qū)的地址
uint vNumberOfBytesRead =0;
Byte bt =new Byte();
//IntPtr id = FindWindow(QEC, EC);
uint hProcess = OpenProcess(PROCESS_ALL_ACCESS, false, pid(jincheng));
//pid(0);
IntPtr fanhui =new IntPtr();
String gg =null;
//if (hProcess == 0)
//{
if (ReadProcessMemory(hProcess, dizhi, vBytesAddress, (uint)vBuffer.Length, ref hProcess))
{
CloseHandle(hProcess);
}
else
{
CloseHandle(hProcess);
}
// }
int vInt = Marshal.ReadInt32(vBytesAddress);
return vInt.ToString();
}
///<summary>
/// 獲取鍵盤狀態(tài)
///</summary>
///<param name="Key"></param>
///<returns></returns>
publicbool GetState(VirtualKeys Key)
{
return (GetKeyState((int)Key) ==1);
}
///<summary>
/// 發(fā)送鍵盤事件
///</summary>
///<returns></returns>
publicvoid Send(VirtualKeys Key, bool State)
{
if (State != GetState(Key))
{
byte a = MapVirtualKey((byte)Key, 0);
keybd_event((byte)Key, MapVirtualKey((byte)Key, 0), 0, 0);
System.Threading.Thread.Sleep(1000);
keybd_event((byte)Key, MapVirtualKey((byte)Key, 0), KEYEVENTF_KEYUP, 0);
}
}
///<summary>
/// 初始化winio
///</summary>
publicvoid sendwinio()
{
if (InitializeWinIo())
{
KBCWait4IBE();
}
}
privatevoid KBCWait4IBE() //等待鍵盤緩沖區(qū)為空
{
//int[] dwVal = new int[] { 0 };
int dwVal =0;
do
{
//這句表示從&H64端口讀取一個(gè)字節(jié)并把讀出的數(shù)據(jù)放到變量dwVal中
//GetPortVal函數(shù)的用法是GetPortVal 端口號(hào),存放讀出數(shù)據(jù)的變量,讀入的長(zhǎng)度
bool flag = GetPortVal((IntPtr)0x64, out dwVal, 1);
}
while ((dwVal &0x2) >0);
}
///<summary>
/// 模擬鍵盤標(biāo)按下
///</summary>
///<param name="vKeyCoad"></param>
publicvoid MykeyDown(int vKeyCoad)
{
int btScancode =0;
btScancode = MapVirtualKey((byte)vKeyCoad, 0);
// btScancode = vKeyCoad;
KBCWait4IBE(); // '發(fā)送數(shù)據(jù)前應(yīng)該先等待鍵盤緩沖區(qū)為空
SetPortVal(KBC_KEY_CMD, (IntPtr)0xD2, 1);// '發(fā)送鍵盤寫入命令
//SetPortVal函數(shù)用于向端口寫入數(shù)據(jù)，它的用法是SetPortVal 端口號(hào),欲寫入的數(shù)據(jù)，寫入數(shù)據(jù)的長(zhǎng)度
KBCWait4IBE();
SetPortVal(KBC_KEY_DATA, (IntPtr)0xe2, 1);// '寫入按鍵信息,按下鍵
KBCWait4IBE(); // '發(fā)送數(shù)據(jù)前應(yīng)該先等待鍵盤緩沖區(qū)為空
SetPortVal(KBC_KEY_CMD, (IntPtr)0xD2, 1);// '發(fā)送鍵盤寫入命令
//SetPortVal函數(shù)用于向端口寫入數(shù)據(jù)，它的用法是SetPortVal 端口號(hào),欲寫入的數(shù)據(jù)，寫入數(shù)據(jù)的長(zhǎng)度
KBCWait4IBE();
SetPortVal(KBC_KEY_DATA, (IntPtr)btScancode, 1);// '寫入按鍵信息,按下鍵
}
///<summary>
/// 模擬鍵盤彈出
///</summary>
///<param name="vKeyCoad"></param>
publicvoid MykeyUp(int vKeyCoad)
{
int btScancode =0;
btScancode = MapVirtualKey((byte)vKeyCoad, 0);
//btScancode = vKeyCoad;
KBCWait4IBE(); // '發(fā)送數(shù)據(jù)前應(yīng)該先等待鍵盤緩沖區(qū)為空
SetPortVal(KBC_KEY_CMD, (IntPtr)0xD2, 1); //'發(fā)送鍵盤寫入命令
KBCWait4IBE();
SetPortVal(KBC_KEY_DATA, (IntPtr)0xe0, 1);// '寫入按鍵信息，釋放鍵
KBCWait4IBE(); // '發(fā)送數(shù)據(jù)前應(yīng)該先等待鍵盤緩沖區(qū)為空
SetPortVal(KBC_KEY_CMD, (IntPtr)0xD2, 1); //'發(fā)送鍵盤寫入命令
KBCWait4IBE();
SetPortVal(KBC_KEY_DATA, (IntPtr)btScancode, 1);// '寫入按鍵信息，釋放鍵
}
///<summary>
/// 模擬鼠標(biāo)按下
///</summary>
///<param name="vKeyCoad"></param>
publicvoid MyMouseDown(int vKeyCoad)
{
int btScancode =0;
btScancode = MapVirtualKey((byte)vKeyCoad, 0);
//btScancode = vKeyCoad;
KBCWait4IBE(); // '發(fā)送數(shù)據(jù)前應(yīng)該先等待鍵盤緩沖區(qū)為空
SetPortVal(KBC_KEY_CMD, (IntPtr)0xD3, 1);// '發(fā)送鍵盤寫入命令
//SetPortVal函數(shù)用于向端口寫入數(shù)據(jù)，它的用法是SetPortVal 端口號(hào),欲寫入的數(shù)據(jù)，寫入數(shù)據(jù)的長(zhǎng)度
KBCWait4IBE();
SetPortVal(KBC_KEY_DATA, (IntPtr)(btScancode |0x80), 1);// '寫入按鍵信息,按下鍵
}
///<summary>
/// 模擬鼠標(biāo)彈出
///</summary>
///<param name="vKeyCoad"></param>
publicvoid MyMouseUp(int vKeyCoad)
{
int btScancode =0;
btScancode = MapVirtualKey((byte)vKeyCoad, 0);
// btScancode = vKeyCoad;
KBCWait4IBE(); // '發(fā)送數(shù)據(jù)前應(yīng)該先等待鍵盤緩沖區(qū)為空
SetPortVal(KBC_KEY_CMD, (IntPtr)0xD3, 1); //'發(fā)送鍵盤寫入命令
KBCWait4IBE();
SetPortVal(KBC_KEY_DATA, (IntPtr)(btScancode |0x80), 1);// '寫入按鍵信息，釋放鍵
}
///<summary>
/// 發(fā)送鼠標(biāo)事件
///</summary>
///<returns></returns>
publicvoid SendMouse()
{
}
///<summary>
/// 鼠標(biāo)動(dòng)作枚舉
///</summary>
publicenum mouseeventflag : uint
{
move =0x0001,
leftdown =0x0002,
leftup =0x0004,
rightdown =0x0008,
rightup =0x0010,
middledown =0x0020,
middleup =0x0040,
xdown =0x0080,
xup =0x0100,
wheel =0x0800,
virtualdesk =0x4000,
absolute =0x8000
}
///<summary>
/// 鍵盤動(dòng)作枚舉
///</summary>
publicenum VirtualKeys : byte
{
//VK_NUMLOCK = 0x90, //數(shù)字鎖定鍵
//VK_SCROLL = 0x91, //滾動(dòng)鎖定
//VK_CAPITAL = 0x14, //大小寫鎖定
//VK_A = 62, //鍵盤A
VK_LBUTTON =1, //鼠標(biāo)左鍵
VK_RBUTTON =2, //鼠標(biāo)右鍵
VK_CANCEL =3, //Ctrl+Break(通常不需要處理)
VK_MBUTTON =4, //鼠標(biāo)中鍵
VK_BACK =8, //Backspace
VK_TAB =9, //Tab
VK_CLEAR =12, //Num Lock關(guān)閉時(shí)的數(shù)字鍵盤5
VK_RETURN =13, //Enter(或者另一個(gè))
VK_SHIFT =16, //Shift(或者另一個(gè))
VK_CONTROL =17, //Ctrl(或者另一個(gè)）
VK_MENU =18, //Alt(或者另一個(gè))
VK_PAUSE =19, //Pause
VK_CAPITAL =20, //Caps Lock
VK_ESCAPE =27, //Esc
VK_SPACE =32, //Spacebar
VK_PRIOR =33, //Page Up
VK_NEXT =34, //Page Down
VK_END =35, //End
VK_HOME =36, //Home
VK_LEFT =37, //左箭頭
VK_UP =38, //上箭頭
VK_RIGHT =39, //右箭頭
VK_DOWN =40, //下箭頭
VK_SELECT =41, //可選
VK_PRINT =42, //可選
VK_EXECUTE =43, //可選
VK_SNAPSHOT =44, //Print Screen
VK_INSERT =45, //Insert
VK_DELETE =46, //Delete
VK_HELP =47, //可選
VK_NUM0 =48, //0
VK_NUM1 =49, //1
VK_NUM2 =50, //2
VK_NUM3 =51, //3
VK_NUM4 =52, //4
VK_NUM5 =53, //5
VK_NUM6 =54, //6
VK_NUM7 =55, //7
VK_NUM8 =56, //8
VK_NUM9 =57, //9
VK_A =65, //A
VK_B =66, //B
VK_C =67, //C
VK_D =68, //D
VK_E =69, //E
VK_F =70, //F
VK_G =71, //G
VK_H =72, //H
VK_I =73, //I
VK_J =74, //J
VK_K =75, //K
VK_L =76, //L
VK_M =77, //M
VK_N =78, //N
VK_O =79, //O
VK_P =80, //P
VK_Q =81, //Q
VK_R =82, //R
VK_S =83, //S
VK_T =84, //T
VK_U =85, //U
VK_V =86, //V
VK_W =87, //W
VK_X =88, //X
VK_Y =89, //Y
VK_Z =90, //Z
VK_NUMPAD0 =96, //0
VK_NUMPAD1 =97, //1
VK_NUMPAD2 =98, //2
VK_NUMPAD3 =99, //3
VK_NUMPAD4 =100, //4
VK_NUMPAD5 =101, //5
VK_NUMPAD6 =102, //6
VK_NUMPAD7 =103, //7
VK_NUMPAD8 =104, //8
VK_NUMPAD9 =105, //9
VK_NULTIPLY =106, //數(shù)字鍵盤上的*
VK_ADD =107, //數(shù)字鍵盤上的+
VK_SEPARATOR =108, //可選
VK_SUBTRACT =109, //數(shù)字鍵盤上的-
VK_DECIMAL =110, //數(shù)字鍵盤上的.
VK_DIVIDE =111, //數(shù)字鍵盤上的/
VK_F1 =112,
VK_F2 =113,
VK_F3 =114,
VK_F4 =115,
VK_F5 =116,
VK_F6 =117,
VK_F7 =118,
VK_F8 =119,
VK_F9 =120,
VK_F10 =121,
VK_F11 =122,
VK_F12 =123,
VK_NUMLOCK =144, //Num Lock
VK_SCROLL =145 // Scroll Lock
}
}
注:using System.Management需要添加System.Management的引用,否則編譯容易出錯(cuò)
相關(guān)文章
richtextbox控件插入鏈接,暫時(shí)使用這個(gè)來解決鏈接的中文文本顯示2013-12-12
這篇文章主要為大家詳細(xì)介紹了C#單位轉(zhuǎn)換器簡(jiǎn)單案例，一個(gè)簡(jiǎn)單的winform應(yīng)用程序，具有一定的參考價(jià)值，感興趣的小伙伴們可以參考一下2017-02-02
這篇文章主要介紹了C#串口通信模塊使用方法示例，文中通過示例代碼介紹的非常詳細(xì)，對(duì)大家的學(xué)習(xí)或者工作具有一定的參考學(xué)習(xí)價(jià)值，需要的朋友們下面隨著小編來一起學(xué)習(xí)學(xué)習(xí)吧2020-06-06
c#(Socket)異步套接字代碼示例...2007-03-03
利用C#代碼實(shí)現(xiàn)圖片旋轉(zhuǎn)360度
本文介紹利用C#代碼實(shí)現(xiàn)圖片旋轉(zhuǎn)360度,具體實(shí)例代碼已附上，僅供大家參考，希望對(duì)大家有所幫助2016-11-11
C#實(shí)現(xiàn)appSettings節(jié)點(diǎn)讀取與修改的方法
這篇文章主要介紹了C#實(shí)現(xiàn)appSettings節(jié)點(diǎn)讀取與修改的方法,是非常實(shí)用的技巧,需要的朋友可以參考下2014-10-10
List轉(zhuǎn)換成DataSet實(shí)現(xiàn)代碼
怎樣把List轉(zhuǎn)換成DataSet本人很是疑惑，于是搜集整理一番，需要的朋友可以參考下2012-12-12
C# L型棋牌覆蓋實(shí)現(xiàn)代碼與效果，需要的朋友可以參考一下2013-04-04
C#常見應(yīng)用函數(shù)實(shí)例小結(jié)
這篇文章主要介紹了C#常見應(yīng)用函數(shù),結(jié)合實(shí)例形式總結(jié)分析了C#常用的時(shí)間、URL、HTML、反射、小數(shù)運(yùn)算等相關(guān)函數(shù),需要的朋友可以參考下2017-01-01
Unity UGUI教程之實(shí)現(xiàn)滑頁效果
使用UGUI提供的ScrollRect和ScrollBar組件實(shí)現(xiàn)基本滑動(dòng)以及自己控制每次移動(dòng)一頁來達(dá)到滑頁的效果。具體實(shí)現(xiàn)思路請(qǐng)參考下本教程2016-04-04