Lire la valeur d'une Address Memory [VB.NET]

**IFireEagle** · 07/01/2015, 18h21

Bonjour, je code un petit programme en VB.Net, mais je ne sais pas comment faire pour lire la valeur d'une Adress Memory spécifique d'un processus et de stocker celle-ci dans une variable (image ici). J'ai cherché partout sur google, j'ai trouvé pleins de chose, j'ai trouvé ce morceau de code:

J'ai trouvé un bout de code avec ta recherche Google, j'y est mis ma propre adresse (celle-ci) à "ReadAddress = &H11936DE&", le problème c'est qu'il me trouve une erreur ici: "ReadProcessMemory(p(0).Handle.ToInt32, ReadAddress, AddressValue, 4, 0)", il dit "'p' n'est pas déclaré. Il peut être inaccessible en raison de son niveau de protection.", je veux remplacer le "p" par mon processus, donc je pense comme ça " ReadProcessMemory("Processus.exe"(0).Handle.ToInt32, ReadAddress, AddressValue, 4, 0)", sauf qu'il me dit "'Handle' n'est pas un membre de 'Char'.", je ne comprend pas trop comment faire pour mettre mon processus

Code :

Sélectionner tout - Visualiser dans une fenêtre à part

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
Imports System.Runtime.InteropServices
 
Public Class Form1
 
    Private Declare Function ReadProcessMemory Lib "kernel32" ( _
    ByVal hProcess As Integer, _
    ByVal lpBaseAddress As Integer, _
    ByRef lpBuffer As Long, _
    ByVal nSize As Integer, _
    ByRef lpNumberOfBytesWritten As Integer _
    ) As Integer
 
    Public Sub ReadAddress()
        Dim ReadAddress As Integer
        Dim AddressValue As Integer
        ReadAddress = &H11936DE&
 
        ReadProcessMemory(p(0).Handle.ToInt32, ReadAddress, AddressValue, 4, 0)
        Label1.Text = AddressValue
    End Sub
 
    Private Sub Button1_Click(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles Button1.Click
 
        ReadAddress()
 
    End Sub

Merci d'avance.

**wallace1** · 07/01/2015, 19h56

Bonsoir,

Il va falloir être plus clair sur ce que tu souhaites faire car en l'état "personnellement" ton problème je n'y comprends absolument rien !!!

Merci.

PS : Si qqun a compris merci d'éclaircir tout ça.....

A+

**IFireEagle** · 07/01/2015, 20h11

Excuse-moi, je connais pas trop le vocabulaire approprié, je vais essayer de mieux détailler:
Je veux lire la mémoire dans un processus, et y lire la valeur d'un offset ? ou une adresse ? spécifique (voir image citer en haut), cette valeur c'est soit 1 ou 0 , et la stocker dans une variable.

**Pol63** · 07/01/2015, 20h12

google:direct memory access vb.net

**IFireEagle** · 08/01/2015, 11h51

Merci beaucoup, je regarderais ça plus tard, mais je crois bien que c'est ça !!

**IFireEagle** · 08/01/2015, 17h54

J'ai trouvé un bout de code avec ta recherche Google, j'y est mis ma propre adresse (celle-ci) à "ReadAddress = &H11936DE&", le problème c'est qu'il me trouve une erreur ici: "ReadProcessMemory(p(0).Handle.ToInt32, ReadAddress, AddressValue, 4, 0)", il dit "'p' n'est pas déclaré. Il peut être inaccessible en raison de son niveau de protection.", je veux remplacer le "p" par mon processus, donc je pense comme ça " ReadProcessMemory("Processus.exe"(0).Handle.ToInt32, ReadAddress, AddressValue, 4, 0)", sauf qu'il me dit "'Handle' n'est pas un membre de 'Char'.", je ne comprend pas trop comment faire pour mettre mon processus

Code :

Sélectionner tout - Visualiser dans une fenêtre à part

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
Imports System.Runtime.InteropServices
 
Public Class Form1
 
    Private Declare Function ReadProcessMemory Lib "kernel32" ( _
    ByVal hProcess As Integer, _
    ByVal lpBaseAddress As Integer, _
    ByRef lpBuffer As Long, _
    ByVal nSize As Integer, _
    ByRef lpNumberOfBytesWritten As Integer _
    ) As Integer
 
    Public Sub ReadAddress()
        Dim ReadAddress As Integer
        Dim AddressValue As Integer
        ReadAddress = &H11936DE&
 
        ReadProcessMemory(p(0).Handle.ToInt32, ReadAddress, AddressValue, 4, 0)
        Label1.Text = AddressValue
    End Sub
 
    Private Sub Button1_Click(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles Button1.Click
 
        ReadAddress()
 
    End Sub

Pouvez-vous m'aidez à comprend mes erreurs ?
Merci.

**Pol63** · 08/01/2015, 18h32

si ca te demande un handle de processus, il faut donner un handle de processus, pas essayer d'écrire au hasard

system.diagnostics.process.getprocesses te donne la liste des processus en cours
trouve le bon (boucle) puis fait .handle dessus, ca doit exister je pense

sinon dans un premier temps tu peux regarder dans le gestionaire des taches qui peut afficher les handle des processus, et le mettre en dur dans le code pour des tests

**IFireEagle** · 08/01/2015, 19h10

Y a pas moyen de modifier mon code pour juste mettre le nom du processus ?

J'ai essayer ceci:

Code :

Sélectionner tout - Visualiser dans une fenêtre à part

1
2
3
4
5
6
7
8
9
10
    Private Declare Function ReadProcessMemory Lib "kernel32" (ByVal hProcess As Integer, ByVal lpBaseAddress As Integer, ByRef lpBuffer As Single, ByVal nSize As Integer, ByRef lpNumberOfBytesWritten As Integer) As Integer
 
    Public Sub ReadAddress()
        Dim ReadAddress As Integer
        Dim ProcessName As Process() = Process.GetProcessesByName("Nom du processus")
        Dim AddressValue As Integer
        ReadAddress = &HD936DE
 
        ReadProcessMemory(ProcessName(0).Handle.ToInt32, ReadAddress, AddressValue, 4, 0)
        Label1.Text = AddressValue

Maintenant, je peut lancer mon application, mais quand je clique sur mon bouton mon récupérer la valeur, ça me fait un message d'erreur "L'opération arithmétique a provoqué un dépassement de capacité.", à vrai dire, je ne sais pas ce que c'est un handle, ni comment le récupérer.

Ah et aussi le "4", quand je le met en dessous de 4, y a plus d'erreur mais, mais ça m'affiche seulement un "0" dans mon Label, alors que cela devrait être "1".
En faite je ne comprend pas le code.

**Pol63** · 08/01/2015, 19h30

le 3ème paramètre de ReadProcessMemory est un single (nombre décimal) et toi tu lui mets un integer

**Pol63** · 08/01/2015, 19h34

pour la compréhension du code :

Code :

Sélectionner tout - Visualiser dans une fenêtre à part

1
2
3
4
5
6
7
8
9
10
11
12
13
14
 
 Private Declare Function ReadProcessMemory Lib "kernel32" (ByVal hProcess As Integer, ByVal lpBaseAddress As Integer, ByRef lpBuffer As Single, ByVal nSize As Integer, ByRef lpNumberOfBytesWritten As Integer) As Integer
           ' déclaration d'une fonction de windows qu'on va utiliser, on peut voir les paramètres (noms et types)
 
    Public Sub ReadAddress()
        Dim ReadAddress As Integer
        Dim ProcessName As Process() = Process.GetProcessesByName("Nom du processus") ' getprocessesbyname retourne un tableau de processus (plusieurs peuvent avoir le même nom à un instant T) le as Process() veut dire que ta variable est un tableau de process
        Dim AddressValue As Integer
        ReadAddress = &HD936DE ' integer en hexadecimal
 
        ReadProcessMemory(ProcessName(0).Handle.ToInt32, ReadAddress, AddressValue, 4, 0)
' ProcessName(0) c'est le 1er processus du tableau qui t'es retourné plus haut
' .handle c'est pour récupérer le handle (un genre d'idenfiant)
' et dans l'histoire ByRef qu'on voit dans la déclaration de la méthode ReadProcessMemory ca veut que c'est un valeur qui sera retournée (la méthode appelée va remplir la variable, que tu affiches en suite)

**antonio2013** · 09/01/2015, 12h53

je procure la version de Visual basic 6.0 en français, il a quelque qui me peut aider a trouver?
Merci d'avance.

**IFireEagle** · 12/01/2015, 11h58

Problème résolu.
Solution.

Il faut créer un nouveau module nommé "ReadWritingMemory" avec comme code:

Code :

Sélectionner tout - Visualiser dans une fenêtre à part

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
Module ReadWritingMemory
    Private Declare Function OpenProcess Lib "kernel32" (ByVal dwDesiredAccess As Integer, ByVal bInheritHandle As Integer, ByVal dwProcessId As Integer) As Integer
 
    Private Declare Function WriteProcessMemory1 Lib "kernel32" Alias "WriteProcessMemory" (ByVal hProcess As Integer, ByVal lpBaseAddress As Integer, ByRef lpBuffer As Integer, ByVal nSize As Integer, ByRef lpNumberOfBytesWritten As Integer) As Integer
    Private Declare Function WriteProcessMemory2 Lib "kernel32" Alias "WriteProcessMemory" (ByVal hProcess As Integer, ByVal lpBaseAddress As Integer, ByRef lpBuffer As Single, ByVal nSize As Integer, ByRef lpNumberOfBytesWritten As Integer) As Single
    Private Declare Function WriteProcessMemory3 Lib "kernel32" Alias "WriteProcessMemory" (ByVal hProcess As Integer, ByVal lpBaseAddress As Integer, ByRef lpBuffer As Long, ByVal nSize As Integer, ByRef lpNumberOfBytesWritten As Integer) As Long
 
    Private Declare Function ReadProcessMemory1 Lib "kernel32" Alias "ReadProcessMemory" (ByVal hProcess As Integer, ByVal lpBaseAddress As Integer, ByRef lpBuffer As Integer, ByVal nSize As Integer, ByRef lpNumberOfBytesWritten As Integer) As Integer
    Private Declare Function ReadProcessMemory2 Lib "kernel32" Alias "ReadProcessMemory" (ByVal hProcess As Integer, ByVal lpBaseAddress As Integer, ByRef lpBuffer As Single, ByVal nSize As Integer, ByRef lpNumberOfBytesWritten As Integer) As Single
    Private Declare Function ReadProcessMemory3 Lib "kernel32" Alias "ReadProcessMemory" (ByVal hProcess As Integer, ByVal lpBaseAddress As Integer, ByRef lpBuffer As Long, ByVal nSize As Integer, ByRef lpNumberOfBytesWritten As Integer) As Long
 
    Const PROCESS_ALL_ACCESS = &H1F0FF
 
    Public Function WriteDMAInteger(ByVal Process As String, ByVal Address As Integer, ByVal Offsets As Integer(), ByVal Value As Integer, ByVal Level As Integer, Optional ByVal nsize As Integer = 4) As Boolean
        Try
            Dim lvl As Integer = Address
            For i As Integer = 1 To Level
                lvl = ReadInteger(Process, lvl, nsize) + Offsets(i - 1)
            Next
            WriteInteger(Process, lvl, Value, nsize)
            Return True
        Catch ex As Exception
            Return False
        End Try
    End Function
 
    Public Function ReadDMAInteger(ByVal Process As String, ByVal Address As Integer, ByVal Offsets As Integer(), ByVal Level As Integer, Optional ByVal nsize As Integer = 4) As Integer
        Try
            Dim lvl As Integer = Address
            For i As Integer = 1 To Level
                lvl = ReadInteger(Process, lvl, nsize) + Offsets(i - 1)
            Next
            Dim vBuffer As Integer
            vBuffer = ReadInteger(Process, lvl, nsize)
            Return vBuffer
        Catch ex As Exception
 
        End Try
    End Function
 
    Public Function WriteDMAFloat(ByVal Process As String, ByVal Address As Integer, ByVal Offsets As Integer(), ByVal Value As Single, ByVal Level As Integer, Optional ByVal nsize As Integer = 4) As Boolean
        Try
            Dim lvl As Integer = Address
            For i As Integer = 1 To Level
                lvl = ReadFloat(Process, lvl, nsize) + Offsets(i - 1)
            Next
            WriteFloat(Process, lvl, Value, nsize)
            Return True
        Catch ex As Exception
            Return False
        End Try
    End Function
 
    Public Function ReadDMAFloat(ByVal Process As String, ByVal Address As Integer, ByVal Offsets As Integer(), ByVal Level As Integer, Optional ByVal nsize As Integer = 4) As Single
        Try
            Dim lvl As Integer = Address
            For i As Integer = 1 To Level
                lvl = ReadFloat(Process, lvl, nsize) + Offsets(i - 1)
            Next
            Dim vBuffer As Single
            vBuffer = ReadFloat(Process, lvl, nsize)
            Return vBuffer
        Catch ex As Exception
 
        End Try
    End Function
 
    Public Function WriteDMALong(ByVal Process As String, ByVal Address As Integer, ByVal Offsets As Integer(), ByVal Value As Long, ByVal Level As Integer, Optional ByVal nsize As Integer = 4) As Boolean
        Try
            Dim lvl As Integer = Address
            For i As Integer = 1 To Level
                lvl = ReadLong(Process, lvl, nsize) + Offsets(i - 1)
            Next
            WriteLong(Process, lvl, Value, nsize)
            Return True
        Catch ex As Exception
            Return False
        End Try
    End Function
 
    Public Function ReadDMALong(ByVal Process As String, ByVal Address As Integer, ByVal Offsets As Integer(), ByVal Level As Integer, Optional ByVal nsize As Integer = 4) As Long
        Try
            Dim lvl As Integer = Address
            For i As Integer = 1 To Level
                lvl = ReadLong(Process, lvl, nsize) + Offsets(i - 1)
            Next
            Dim vBuffer As Long
            vBuffer = ReadLong(Process, lvl, nsize)
            Return vBuffer
        Catch ex As Exception
 
        End Try
    End Function
 
    Public Sub WriteNOPs(ByVal ProcessName As String, ByVal Address As Long, ByVal NOPNum As Integer)
        Dim C As Integer
        Dim B As Integer
        If ProcessName.EndsWith(".exe") Then
            ProcessName = ProcessName.Replace(".exe", "")
        End If
        Dim MyP As Process() = Process.GetProcessesByName(ProcessName)
        If MyP.Length = 0 Then
            MessageBox.Show(ProcessName & " isn't open!")
            Exit Sub
        End If
        Dim hProcess As IntPtr = OpenProcess(PROCESS_ALL_ACCESS, 0, MyP(0).Id)
        If hProcess = IntPtr.Zero Then
            MessageBox.Show("Failed to open " & ProcessName & "!")
            Exit Sub
        End If
 
        B = 0
        For C = 1 To NOPNum
            Call WriteProcessMemory1(hProcess, Address + B, &H90, 1, 0&)
            B = B + 1
        Next C
    End Sub
 
    Public Sub WriteXBytes(ByVal ProcessName As String, ByVal Address As Long, ByVal Value As String)
        If ProcessName.EndsWith(".exe") Then
            ProcessName = ProcessName.Replace(".exe", "")
        End If
        Dim MyP As Process() = Process.GetProcessesByName(ProcessName)
        If MyP.Length = 0 Then
            MessageBox.Show(ProcessName & " isn't open!")
            Exit Sub
        End If
        Dim hProcess As IntPtr = OpenProcess(PROCESS_ALL_ACCESS, 0, MyP(0).Id)
        If hProcess = IntPtr.Zero Then
            MessageBox.Show("Failed to open " & ProcessName & "!")
            Exit Sub
        End If
 
        Dim C As Integer
        Dim B As Integer
        Dim D As Integer
        Dim V As Byte
 
        B = 0
        D = 1
        For C = 1 To Math.Round((Len(Value) / 2))
            V = Val("&H" & Mid$(Value, D, 2))
            Call WriteProcessMemory1(hProcess, Address + B, V, 1, 0&)
            B = B + 1
            D = D + 2
        Next C
 
    End Sub
 
    Public Sub WriteInteger(ByVal ProcessName As String, ByVal Address As Integer, ByVal Value As Integer, Optional ByVal nsize As Integer = 4)
        If ProcessName.EndsWith(".exe") Then
            ProcessName = ProcessName.Replace(".exe", "")
        End If
        Dim MyP As Process() = Process.GetProcessesByName(ProcessName)
        If MyP.Length = 0 Then
            MessageBox.Show(ProcessName & " isn't open!")
            Exit Sub
        End If
        Dim hProcess As IntPtr = OpenProcess(PROCESS_ALL_ACCESS, 0, MyP(0).Id)
        If hProcess = IntPtr.Zero Then
            MessageBox.Show("Failed to open " & ProcessName & "!")
            Exit Sub
        End If
 
        Dim hAddress, vBuffer As Integer
        hAddress = Address
        vBuffer = Value
        WriteProcessMemory1(hProcess, hAddress, CInt(vBuffer), nsize, 0)
    End Sub
 
    Public Sub WriteFloat(ByVal ProcessName As String, ByVal Address As Integer, ByVal Value As Single, Optional ByVal nsize As Integer = 4)
        If ProcessName.EndsWith(".exe") Then
            ProcessName = ProcessName.Replace(".exe", "")
        End If
        Dim MyP As Process() = Process.GetProcessesByName(ProcessName)
        If MyP.Length = 0 Then
            MessageBox.Show(ProcessName & " isn't open!")
            Exit Sub
        End If
        Dim hProcess As IntPtr = OpenProcess(PROCESS_ALL_ACCESS, 0, MyP(0).Id)
        If hProcess = IntPtr.Zero Then
            MessageBox.Show("Failed to open " & ProcessName & "!")
            Exit Sub
        End If
 
        Dim hAddress As Integer
        Dim vBuffer As Single
 
        hAddress = Address
        vBuffer = Value
        WriteProcessMemory2(hProcess, hAddress, vBuffer, nsize, 0)
    End Sub
 
    Public Sub WriteLong(ByVal ProcessName As String, ByVal Address As Integer, ByVal Value As Long, Optional ByVal nsize As Integer = 4)
        If ProcessName.EndsWith(".exe") Then
            ProcessName = ProcessName.Replace(".exe", "")
        End If
        Dim MyP As Process() = Process.GetProcessesByName(ProcessName)
        If MyP.Length = 0 Then
            MessageBox.Show(ProcessName & " isn't open!")
            Exit Sub
        End If
        Dim hProcess As IntPtr = OpenProcess(PROCESS_ALL_ACCESS, 0, MyP(0).Id)
        If hProcess = IntPtr.Zero Then
            MessageBox.Show("Failed to open " & ProcessName & "!")
            Exit Sub
        End If
 
        Dim hAddress As Integer
        Dim vBuffer As Long
 
        hAddress = Address
        vBuffer = Value
        WriteProcessMemory3(hProcess, hAddress, vBuffer, nsize, 0)
    End Sub
 
    Public Function ReadInteger(ByVal ProcessName As String, ByVal Address As Integer, Optional ByVal nsize As Integer = 4) As Integer
        If ProcessName.EndsWith(".exe") Then
            ProcessName = ProcessName.Replace(".exe", "")
        End If
        Dim MyP As Process() = Process.GetProcessesByName(ProcessName)
        If MyP.Length = 0 Then
            MessageBox.Show(ProcessName & " isn't open!")
            Exit Function
        End If
        Dim hProcess As IntPtr = OpenProcess(PROCESS_ALL_ACCESS, 0, MyP(0).Id)
        If hProcess = IntPtr.Zero Then
            MessageBox.Show("Failed to open " & ProcessName & "!")
            Exit Function
        End If
 
        Dim hAddress, vBuffer As Integer
        hAddress = Address
        ReadProcessMemory1(hProcess, hAddress, vBuffer, nsize, 0)
        Return vBuffer
    End Function
 
    Public Function ReadFloat(ByVal ProcessName As String, ByVal Address As Integer, Optional ByVal nsize As Integer = 4) As Single
        If ProcessName.EndsWith(".exe") Then
            ProcessName = ProcessName.Replace(".exe", "")
        End If
        Dim MyP As Process() = Process.GetProcessesByName(ProcessName)
        If MyP.Length = 0 Then
            MessageBox.Show(ProcessName & " isn't open!")
            Exit Function
        End If
        Dim hProcess As IntPtr = OpenProcess(PROCESS_ALL_ACCESS, 0, MyP(0).Id)
        If hProcess = IntPtr.Zero Then
            MessageBox.Show("Failed to open " & ProcessName & "!")
            Exit Function
        End If
 
        Dim hAddress As Integer
        Dim vBuffer As Single
 
        hAddress = Address
        ReadProcessMemory2(hProcess, hAddress, vBuffer, nsize, 0)
        Return vBuffer
    End Function
 
    Public Function ReadLong(ByVal ProcessName As String, ByVal Address As Integer, Optional ByVal nsize As Integer = 4) As Long
        If ProcessName.EndsWith(".exe") Then
            ProcessName = ProcessName.Replace(".exe", "")
        End If
        Dim MyP As Process() = Process.GetProcessesByName(ProcessName)
        If MyP.Length = 0 Then
            MessageBox.Show(ProcessName & " isn't open!")
            Exit Function
        End If
        Dim hProcess As IntPtr = OpenProcess(PROCESS_ALL_ACCESS, 0, MyP(0).Id)
        If hProcess = IntPtr.Zero Then
            MessageBox.Show("Failed to open " & ProcessName & "!")
            Exit Function
        End If
 
        Dim hAddress As Integer
        Dim vBuffer As Long
 
        hAddress = Address
        ReadProcessMemory3(hProcess, hAddress, vBuffer, nsize, 0)
        Return vBuffer
    End Function
 
End Module

Et ensuite mettez ce code dans un bouton ou autre chose:

Code :

Sélectionner tout - Visualiser dans une fenêtre à part

1
2
ReadLong("PROCESSUS", &hADRESSE)
Exemple: Label1.Text = ReadLong("chrome", &h11516HE)

Lire la valeur d'une Address Memory [VB.NET] [Débutant]

VB.NET

Discussions similaires

Partager

Partager