메모리 스캐너 관련질문입니다.
메모리 스캐너를 만들어보고싶어서 외국커뮤니티와 각종 구글 자료를 찾아보았더니
아래와 같은순서로 메모리 스캐너를 작성하라고 되어있었습니다.
1- Get the process address range.
2- We query info about the memory page.
3- Check if we can access this part of memory
4- Check if can we write to the memory
5- dump
6- RPM
7- Check for value in bytes
그래서 저는 아래의 CPP 코드로 코드를 작성하여보았지만 메모리 스캐닝은 잘 되지않는것같습니다.
메모리스캐너를 제작하는데있어서 참고할만한 자료가있다면 알려주시면 감사하겠습니다.
(소스코드 읽기힘드실까봐 따로 cpp파일 첨부합니다.)
void ScanMem(LPCSTR _name)
{
DWORD pid;
HWND hwnd = FindWindowA(NULL, _name);
if (!hwnd)
{
cout << "Window Not Found!" << endl;
return;
}
cout << "hwnd :" << hwnd << endl;
GetWindowThreadProcessId(hwnd, &pid);
if (!pid)
{
cout << "Could not get process ID" << endl;
return;
}
cout << "pid :" << pid << endl;
phandle = OpenProcess(PROCESS_VM_OPERATION | PROCESS_VM_READ | PROCESS_VM_WRITE | PROCESS_QUERY_INFORMATION, 0, pid);
if (!phandle)
{
cout << "Could not get handle!" << endl;
return;
}
SYSTEM_INFO sysInfo;
GetSystemInfo(&sysInfo);
DWORD MemoryStart = (long)sysInfo.lpMinimumApplicationAddress;
DWORD MemoryEnd = (long)sysInfo.lpMaximumApplicationAddress;
DWORD PageSize = sysInfo.dwPageSize;
cout << "MemoryStart : " << MemoryStart << endl;
cout << "MemoryEnd : " << MemoryEnd << endl;
cout << "PageSize : " << PageSize << endl;
MEMORY_BASIC_INFORMATION mbi;
while (MemoryStart < MemoryEnd)
{
VirtualQuery((LPCVOID)MemoryStart, &mbi, sizeof(mbi));
if (mbi.State == MEM_COMMIT && (mbi.Protect == PAGE_READWRITE || mbi.Protect == PAGE_WRITECOPY || mbi.Protect == PAGE_EXECUTE_READWRITE || mbi.Protect == PAGE_EXECUTE_WRITECOPY))
{
DWORD value;
cout << "BaseAddress : " << mbi.BaseAddress << endl;
ReadProcessMemory(phandle, mbi.AllocationBase, &value, mbi.RegionSize, NULL);
cout << "value : " << value << endl;
}
MemoryStart += PageSize;
}
}
아래와 같은순서로 메모리 스캐너를 작성하라고 되어있었습니다.
1- Get the process address range.
2- We query info about the memory page.
3- Check if we can access this part of memory
4- Check if can we write to the memory
5- dump
6- RPM
7- Check for value in bytes
그래서 저는 아래의 CPP 코드로 코드를 작성하여보았지만 메모리 스캐닝은 잘 되지않는것같습니다.
메모리스캐너를 제작하는데있어서 참고할만한 자료가있다면 알려주시면 감사하겠습니다.
(소스코드 읽기힘드실까봐 따로 cpp파일 첨부합니다.)
void ScanMem(LPCSTR _name)
{
DWORD pid;
HWND hwnd = FindWindowA(NULL, _name);
if (!hwnd)
{
cout << "Window Not Found!" << endl;
return;
}
cout << "hwnd :" << hwnd << endl;
GetWindowThreadProcessId(hwnd, &pid);
if (!pid)
{
cout << "Could not get process ID" << endl;
return;
}
cout << "pid :" << pid << endl;
phandle = OpenProcess(PROCESS_VM_OPERATION | PROCESS_VM_READ | PROCESS_VM_WRITE | PROCESS_QUERY_INFORMATION, 0, pid);
if (!phandle)
{
cout << "Could not get handle!" << endl;
return;
}
SYSTEM_INFO sysInfo;
GetSystemInfo(&sysInfo);
DWORD MemoryStart = (long)sysInfo.lpMinimumApplicationAddress;
DWORD MemoryEnd = (long)sysInfo.lpMaximumApplicationAddress;
DWORD PageSize = sysInfo.dwPageSize;
cout << "MemoryStart : " << MemoryStart << endl;
cout << "MemoryEnd : " << MemoryEnd << endl;
cout << "PageSize : " << PageSize << endl;
MEMORY_BASIC_INFORMATION mbi;
while (MemoryStart < MemoryEnd)
{
VirtualQuery((LPCVOID)MemoryStart, &mbi, sizeof(mbi));
if (mbi.State == MEM_COMMIT && (mbi.Protect == PAGE_READWRITE || mbi.Protect == PAGE_WRITECOPY || mbi.Protect == PAGE_EXECUTE_READWRITE || mbi.Protect == PAGE_EXECUTE_WRITECOPY))
{
DWORD value;
cout << "BaseAddress : " << mbi.BaseAddress << endl;
ReadProcessMemory(phandle, mbi.AllocationBase, &value, mbi.RegionSize, NULL);
cout << "value : " << value << endl;
}
MemoryStart += PageSize;
}
}