32位程序读取64位进程内存

//第一步：//定義函數參數結構
typedef NTSTATUS(NTAPI *LPFN_NTWOW64READVIRTUALMEMORY64)(
IN HANDLE ProcessHandle,
IN ULONG64 BaseAddress,
OUT PVOID BufferData,
IN ULONG64 BufferLength,
OUT PULONG64 ReturnLength OPTIONAL);

typedef NTSTATUS(NTAPI *LPFN_NTWOW64WRITEVIRTUALMEMORY64)(
IN HANDLE ProcessHandle,
IN ULONG64 BaseAddress,
OUT PVOID BufferData,
IN ULONG64 BufferLength,
OUT PULONG64 ReturnLength OPTIONAL);
//第二步
//LPFN_NTWOW64QUERYINFORMATIONPROCESS64
HMODULE NtdllModuleBase;
LPFN_NTWOW64READVIRTUALMEMORY64 __NtWow64ReadVirtualMemory64;
//LPFN_NTWOW64WRITEVIRTUALMEMORY64 __NtWow64WriteVirtualMemory64;

//第三步：
__NtWow64ReadVirtualMemory64 = (LPFN_NTWOW64READVIRTUALMEMORY64)GetProcAddress(NtdllModuleBase,
“NtWow64ReadVirtualMemory64”);

__NtWow64WriteVirtualMemory64 = (LPFN_NTWOW64WRITEVIRTUALMEMORY64)GetProcAddress(NtdllModuleBase,
    "NtWow64WriteVirtualMemory64");

//例子： 和ReadProcessMemory用法差不多
讀取矩陣地址
// __NtWow64ReadVirtualMemory64(hProcess, module_address + 0x19386D8, &aaa, sizeof(DWORD64), 0);
// __NtWow64ReadVirtualMemory64(hProcess, aaa + 0x1FC, &bbb, sizeof(DWORD64), 0);
// __NtWow64ReadVirtualMemory64(hProcess, bbb + 0xA4, &aaa, sizeof(DWORD64), 0);
// __NtWow64ReadVirtualMemory64(hProcess, aaa + 0x20, &bbb, sizeof(DWORD64), 0);
// __NtWow64ReadVirtualMemory64(hProcess, bbb + 0x1F8, &aaa, sizeof(DWORD64), 0);
// __NtWow64ReadVirtualMemory64(hProcess, aaa + 0x30, &bbb, sizeof(DWORD64), 0);
// __NtWow64ReadVirtualMemory64(hProcess, bbb+0x1BE0, location2, sizeof(location2), 0);

标签：__,LPFN,32,NtWow64ReadVirtualMemory64,bbb,64,内存,sizeof,hProcess
来源： https://blog.csdn.net/htpidk/article/details/120678990