我正在編寫一個枚舉進程基地址的函數。這是通過一些 Windows API 調用完成的，但是，我相信是我的調用EnumProcessModules造成了錯誤。還應該注意的是，并不是每個進程都會發生此錯誤。我已經嘗試過將一些 uint32 更改為 uint64，反之亦然，以及創建數組的不同方法moduleHandles，但我無法讓任何東西工作。這只是我正在創建的應用程序中的一個函數，用于檢索和掃描另一個進程的內存。這是我的函數的源代碼：func getBaseAddress(handle uintptr) int64 { // GetProcessImageFileNameA var imageFileName [200]byte var fileSize uint32 = 200 var fileName string ret, _, _ := procGetProcessImageFileNameA.Call(handle, uintptr(unsafe.Pointer(&imageFileName)), uintptr(fileSize)) for _, char := range imageFileName { if char == 0 { break } fileName += string(char) } fileName = fileName[24:] // EnumProcessModules var n uint32 var needed uint64 ret, _, _ = procEnumProcessModules.Call(handle, 0, uintptr(n), uintptr(unsafe.Pointer(&needed))) moduleHandles := make([]syscall.Handle, int(needed)) if ret == 1 && needed > 0 { ret, _, _ = procEnumProcessModules.Call(handle, uintptr(unsafe.Pointer(&moduleHandles)), uintptr(needed), uintptr(unsafe.Pointer(&needed))) } // GetModuleFileNameExA var finalModuleHandle uintptr for _, moduleHandle := range moduleHandles { if moduleHandle > 0 { var moduleFileName [200]byte var moduleSize uint32 = 200 var moduleName string ret, _, _ = procGetModuleFileNameExA.Call(handle, uintptr(moduleHandle), uintptr(unsafe.Pointer(&moduleFileName)), uintptr(moduleSize)) if ret != 0 { for _, char := range moduleFileName { if char == 0 { break } moduleName += string(char) } moduleName = moduleName[3:] if moduleName == fileName { finalModuleHandle = uintptr(moduleHandle) break } } } } return int64(finalModuleHandle)}
2 回答
富國滬深
TA貢獻1790條經驗 獲得超9個贊
我想通了這個問題。我與錯誤的人互動EnumProcessModules。這是一個工作函數：
func getBaseAddress(handle uintptr) int64 {
// GetProcessImageFileNameA
var imageFileName [200]byte
var fileSize uint32 = 200
var fileName string
ret, _, _ := procGetProcessImageFileNameA.Call(handle, uintptr(unsafe.Pointer(&imageFileName)), uintptr(fileSize))
for _, char := range imageFileName {
if char == 0 {
break
}
fileName += string(char)
}
fileName = fileName[24:]
// EnumProcessModules
moduleHandles := make([]uintptr, 1024)
var needed int32
const handleSize = unsafe.Sizeof(moduleHandles[0])
ret, _, _ = procEnumProcessModules.Call(uintptr(handle), uintptr(unsafe.Pointer(&moduleHandles[0])), handleSize*uintptr(len(moduleHandles)), uintptr(unsafe.Pointer(&needed)))
// GetModuleFileNameExA
var finalModuleHandle uintptr
for _, moduleHandle := range moduleHandles {
if moduleHandle > 0 {
var moduleFileName [200]byte
var moduleSize uint32 = 200
var moduleName string
ret, _, _ = procGetModuleFileNameExA.Call(handle, uintptr(moduleHandle), uintptr(unsafe.Pointer(&moduleFileName)), uintptr(moduleSize))
if ret != 0 {
for _, char := range moduleFileName {
if char == 0 {
break
}
moduleName += string(char)
}
moduleName = moduleName[3:]
if moduleName == fileName {
finalModuleHandle = uintptr(moduleHandle)
break
}
}
}
}
return int64(finalModuleHandle)
}
我希望這可以幫助別人，我花了很多時間在這個功能上。
- 2 回答
- 0 關注
- 185 瀏覽