一个读其他进程内存的程序，调了三天了，毫无结果。附源程序，帮忙瞧瞧

我想读其他进程的内存放入文件中以供分析。程序很简单，就没写注释。
现在问题是执行 VirtualQueryEx 后 MBI.State 总是为 MEM_RESERVE（8192），无法读取。
还有一个问题很奇怪，当我读取本进程的内存时（把注释打开），MBI.RegionSize 的内容明明是4096，但 lActualGetSize 却返回 3284 ，并且读出的内容也和FPE不同，令我百思不得其解。
附源程序如下，请高手帮忙：

'form
Option Explicit

Private Sub cmdGetMem_Click()
Dim hWindSearch As Long
Dim lMBILength As Long
Dim lpAddress As Long
Dim lProcessId As Long
Dim lThreadId As Long
Dim hProcess As Long
Dim lpBuffer As Long
Dim bytBuffer() As Byte
Dim lActualGetSize As Long
Dim intFileNO As Integer
Dim intFileNO1 As Integer
Dim strFileName As String
Dim strFileName1 As String
Dim lSizeMemToFile As Long

    hWindSearch = FindWindow(vbNullString, "Form1")
    If hWindSearch = 0 Then
        MsgBox "FindWindow Failed"
        Exit Sub
    End If

    strFileName = "d:\MemFile.txt"
    intFileNO = FreeFile()
    Open strFileName For Binary As #intFileNO
    intFileNO1 = FreeFile()
    strFileName1 = "d:\MemFile1.txt"
    Open strFileName1 For Output As #intFileNO1
    lSizeMemToFile = 0

    lMBILength = Len(MBI)
    lpAddress = &H400000
    lThreadId = GetWindowThreadProcessId(hWindSearch, lProcessId)
'    lThreadId = GetWindowThreadProcessId(Me.hwnd, lProcessId)
    hProcess = OpenProcess(PROCESS_ALL_ACCESS, False, lProcessId)
    If lMBILength <> VirtualQueryEx(hProcess, lpAddress, MBI, lMBILength) Then
        MsgBox "VirtualQueryEx Failed"
        GoTo ExitSub
    End If
    ReDim Preserve bytBuffer(MBI.RegionSize - 1) As Byte
    Do While True
        If MBI.State = MEM_COMMIT Then
            Select Case (MBI.Protect And Not (PAGE_GUARD Or PAGE_NOCACHE))
                Case PAGE_READWRITE:
                    Call ReadProcessMemory(hProcess, lpAddress, bytBuffer(0), MBI.RegionSize, lActualGetSize)
                    Put #intFileNO, , bytBuffer
                    Write #intFileNO1, Hex(lpAddress / MBI.RegionSize), lActualGetSize
                    lSizeMemToFile = lSizeMemToFile + lActualGetSize
                    If lSizeMemToFile >= &H400000 Then
                        MsgBox "4M File Written"
                        Exit Do
                    End If
            End Select
        End If
        If lpAddress <= &H7FFFFFFF - MBI.RegionSize Then
            MsgBox "Arrive Memory End"
            Exit Do
        End If
        lpAddress = lpAddress + MBI.RegionSize
        If lMBILength <> VirtualQueryEx(hProcess, lpAddress, MBI, lMBILength) Then
            MsgBox "VirtualQueryEx Failed"
            Exit Do
        End If
    Loop

ExitSub:
    CloseHandle hProcess
    Close intFileNO
    Close intFileNO1

End Sub

'模块
Option Explicit

Public Declare Function OpenProcess Lib "kernel32" (ByVal dwDesiredAccess As Long, ByVal bInheritHandle As Long, ByVal dwProcessId As Long) As Long
Public Declare Function ReadProcessMemory Lib "kernel32" (ByVal hProcess As Long, lpBaseAddress As Any, lpBuffer As Any, ByVal nSize As Long, lpNumberOfBytesWritten As Long) As Long
Public Declare Function WriteProcessMemory Lib "kernel32" (ByVal hProcess As Long, lpBaseAddress As Any, lpBuffer As Any, ByVal nSize As Long, lpNumberOfBytesWritten As Long) As Long
Public Declare Function SetForegroundWindow Lib "user32" (ByVal hwnd As Long) As Long
Public Declare Function FindWindow Lib "user32" Alias "FindWindowA" (ByVal lpClassName As String, ByVal lpWindowName As String) As Long
Public Declare Function VirtualProtectEx Lib "kernel32" (ByVal hProcess As Long, lpAddress As Any, ByVal dwSize As Long, ByVal flNewProtect As Long, lpflOldProtect As Long) As Long
Public Declare Function CloseHandle Lib "kernel32" (ByVal hObject As Long) As Long

Public Declare Function GetWindowThreadProcessId Lib "user32" (ByVal hwnd As Long, lpdwProcessId As Long) As Long
Public Declare Function VirtualQuery Lib "kernel32" (lpAddress As Any, lpBuffer As MEMORY_BASIC_INFORMATION, ByVal dwLength As Long) As Long
Public Declare Function VirtualQueryEx Lib "kernel32" (ByVal hProcess As Long, lpAddress As Any, lpBuffer As MEMORY_BASIC_INFORMATION, ByVal dwLength As Long) As Long
Public Declare Sub CopyMemory Lib "kernel32" Alias "RtlMoveMemory" (pDst As Any, pSrc As Any, ByVal ByteLen As Long)

Public Type MEMORY_BASIC_INFORMATION
     BaseAddress As Long
     AllocationBase As Long
     AllocationProtect As Long
     RegionSize As Long
     State As Long
     Protect As Long
     lType As Long
End Type

Public Const STANDARD_RIGHTS_REQUIRED = &HF0000
Public Const SYNCHRONIZE = &H100000
Public Const PROCESS_ALL_ACCESS = (STANDARD_RIGHTS_REQUIRED Or SYNCHRONIZE Or &HFFF)
Public Const PROCESS_CREATE_PROCESS = (&H80)
Public Const PROCESS_CREATE_THREAD = (&H2)
Public Const PROCESS_DUP_HANDLE = (&H40)
Public Const PROCESS_HEAP_ENTRY_BUSY = &H4
Public Const PROCESS_HEAP_ENTRY_DDESHARE = &H20
Public Const PROCESS_HEAP_ENTRY_MOVEABLE = &H10
Public Const PROCESS_HEAP_REGION = &H1
Public Const PROCESS_HEAP_UNCOMMITTED_RANGE = &H2
Public Const PROCESS_QUERY_INFORMATION = (&H400)
Public Const PROCESS_SET_INFORMATION = (&H200)
Public Const PROCESS_SET_QUOTA = (&H100)
Public Const PROCESS_SET_SESSIONID = (&H4)
Public Const PROCESS_TERMINATE = (&H1)
Public Const PROCESS_VM_OPERATION = (&H8)
Public Const PROCESS_VM_READ = (&H10)
Public Const PROCESS_VM_WRITE = (&H20)
Public Const PROCESS_XP_HEADER_CACHE = (&H20000)

Public Const MEM_COMMIT = &H1000
Public Const MEM_DECOMMIT = &H4000
Public Const MEM_E_INVALID_LINK = &H80080010
Public Const MEM_E_INVALID_ROOT = &H80080009
Public Const MEM_E_INVALID_SIZE = &H80080011
Public Const MEM_FREE = &H10000
Public Const SEC_IMAGE = &H1000000
Public Const MEM_IMAGE = SEC_IMAGE
Public Const MEM_MAPPED = &H40000
Public Const MEM_PHYSICAL = &H400000
Public Const MEM_PRIVATE = &H20000
Public Const MEM_RELEASE = &H8000
Public Const MEM_RESERVE = &H2000
Public Const MEM_RESET = &H80000
Public Const MEM_TOP_DOWN = &H100000
Public Const MEM_WRITE_WATCH = &H200000

Public Const PAGE_EXECUTE = &H10
Public Const PAGE_EXECUTE_READ = &H20
Public Const PAGE_EXECUTE_READWRITE = &H40
Public Const PAGE_EXECUTE_WRITECOPY = &H80
Public Const PAGE_GUARD = &H100
Public Const PAGE_NOACCESS = &H1
Public Const PAGE_NOCACHE = &H200
Public Const PAGE_READONLY = &H2
Public Const PAGE_READWRITE = &H4
Public Const PAGE_WRITECOMBINE = &H400
Public Const PAGE_WRITECOPY = &H8

Public MBI As MEMORY_BASIC_INFORMATION

7 个解决方案

#1

我運行MBI.State=4096呀.

#2

是吗？！居然有如此怪事？
我用的是win98第一版，不知是不是版本的缘故。
等我切换到2000下看看。

#3

在2000下果然没问题，看来是版本的缘故。但不知98第二版是否有此毛病？哪位仁兄愿意帮小弟试试？在此谢过！

#4

U—————P

#5

怎么会有这种怪事？

#6

fpe倒工作得挺好，如果真是98的毛病，那fpe是怎么做的？

#7

明白了，调用或是声明的时候加个byval 就好了。

#1