windows 如何访问另一个进程的内存并调用它的函数？

How can you access memory of another process and call its functions?

提问by krej

I want to learn how to read other processes memory and have my program call the other processes functions and what not with my own parameters and stuff. I've googled it and it seems like you need to use things like ReadProcessMemory but I haven't been able to find any good tutorials explaining how to use them. Could anyone point me in the right direction to learn things like this? I want to do it in C++ (or java if possible) on Windows (7 and 64bit if that matters).

我想学习如何读取其他进程的内存，并让我的程序调用其他进程的函数，而不是使用我自己的参数和东西。我在谷歌上搜索过它，似乎您需要使用 ReadProcessMemory 之类的东西，但我找不到任何解释如何使用它们的好教程。谁能指出我正确的方向来学习这样的东西？我想在 Windows（7 和 64 位，如果重要的话）上用 C++（如果可能的话，或者 java）来做。

Also, I know this sounds subjective and could be used for malicious purposes, but I guarantee that I will not use any knowledge gained from this for any harmful reasons. I purely want to learn this for fun and to teach myself something new.

此外，我知道这听起来很主观，可能会被用于恶意目的，但我保证我不会出于任何有害原因使用从中获得的任何知识。我纯粹是为了好玩而学习这个，并教自己一些新的东西。

回答by wj32

You can't directly call functions in other processes, because your process and the other process have different address spaces. One way to get around this is by creating a remote thread in the process (using CreateRemoteThread or RtlCreateUserThread), but that only allows you to pass in one parameter to the function. You could try creating a remote thread, writing the parameters to its stack and changing its registers using SetThreadContext. Another way is to inject your own DLL which calls the function.

您不能直接调用其他进程中的函数，因为您的进程和其他进程具有不同的地址空间。解决此问题的一种方法是在进程中创建一个远程线程（使用 CreateRemoteThread 或 RtlCreateUserThread），但这仅允许您将一个参数传递给函数。您可以尝试创建一个远程线程，将参数写入其堆栈并使用 SetThreadContext 更改其寄存器。另一种方法是注入调用该函数的自己的 DLL。

Another problem is locating the function to call. You would probably need to load symbols for EXEs or DLLs where the function you need isn't exported.

另一个问题是定位要调用的函数。您可能需要为未导出您需要的函数的 EXE 或 DLL 加载符号。

For general questions about Windows internals, try asking on Sysinternals Forums.

有关 Windows 内部的一般问题，请尝试在Sysinternals 论坛上提问。

EDIT: What you've stated (reading a string which the process checks against user input) is very difficult to do in a program without knowing the layout of the instructions and data in the image file beforehand. If for example you have a crackme program, you would either use a static analysis tool like IDA Pro or run the program under a debugger. Either way, these things usually require human input and are difficult to do automatically.

编辑：如果事先不知道图像文件中指令和数据的布局，您所说的（读取进程根据用户输入检查的字符串）是非常困难的。例如，如果您有一个crackme 程序，您可以使用像IDA Pro 这样的静态分析工具或在调试器下运行该程序。无论哪种方式，这些事情通常都需要人工输入，并且很难自动完成。

回答by Arun

Processes, by design and by definition, are isolated from each other. They have separate address space.

流程，根据设计和定义，彼此隔离。它们有单独的地址空间。

The operating system keeps its processes separated and allocates the resources they need so that they are less likely to interfere with each other ...

操作系统将其进程分开并分配它们所需的资源，这样它们就不太可能相互干扰......

They can certainlycommunicate, but only if they choose to, through some form of inter-process communication.

他们当然可以通信，但前提是他们选择通过某种形式的进程间通信。

However, threads, sometimes known as lightweight process, share their address space and can read each others' data structures.

然而，线程，有时也称为轻量级进程，共享它们的地址空间并且可以读取彼此的数据结构。

Not sure, what you meant by

不确定，你的意思

call the other processes functions

调用其他进程函数

A function f()can be compiled into multiple processes' executable code. Process A and process B can call f()independently in their context.

一个函数f()可以编译成多个进程的可执行代码。进程 A 和进程 B 可以f()在它们的上下文中独立调用。

Otherwise, process A can "communicate" to process B to perform some action, which for example may be implemented in function g()in B. B can execute it in its context and "communicate" the result back to A.

否则，进程 A 可以“通信”到进程 B 以执行某些操作，例如可以g()在 B中的函数中实现。B 可以在其上下文中执行它并将结果“通信”回 A。

回答by ruslik

I cannot see any beneficial use of this, but anyway. There are at least two ways to make another process call something:

我看不出有什么好处，但无论如何。至少有两种方法可以让另一个进程调用一些东西：

1) CreateRemoteThread(), will create a thread in a process.

1) CreateRemoteThread(), 将在一个进程中创建一个线程。

2) QueueUserAPC()will make an existing thread in that process call a callback function.

2)QueueUserAPC()将使该进程中的现有线程调用回调函数。

If ASLR is disabled, then it's enough to call a function without parameters. Else you'll also need VirtualQueryEx(), ReadProcessMemory()and WriteProcessMemory().

如果禁用了 ASLR，那么调用一个不带参数的函数就足够了。否则，您还需要VirtualQueryEx(),ReadProcessMemory()和WriteProcessMemory()。

Yes, and it's not something to do in java :)

是的，这不是在 Java 中可以做的事情 :)