如何从 Windows 应用程序内存中读取一些数据？

How to read some data from a Windows application memory?

提问by Kirill Leontev

I have an application, which displays me some data. I need to attach to this app's process, find the data I need in memory (one single number, actually), and save it somewhere. This application doesn't seem to use standard windows controls, so things aren't going to be as simple as reading controls data using AutoIt or something similar.

我有一个应用程序，它显示了一些数据。我需要附加到这个应用程序的进程，在内存中找到我需要的数据（实际上是一个数字），并将其保存在某处。这个应用程序似乎没有使用标准的 Windows 控件，所以事情不会像使用 AutoIt 或类似的东西读取控件数据那么简单。

Currently I'm a self-learner database guy and have quite shallow knowledge about windows apps debugging. Not even sure if I asked my question correctly enough.

目前，我是一名自学数据库的人，对 Windows 应用程序调试的知识非常浅薄。甚至不确定我问的问题是否足够正确。

So, can you give me some starter guidelines about, say, what should I read first, and general directions I should work on?

那么，您能否给我一些入门指南，例如，我应该首先阅读什么，以及我应该遵循的一般方向？

Thanks.

谢谢。

回答by Oleg

To read memory of other application you need to open the process with respect of OpenProcesswith at least PROCESS_VM_READaccess rights and then use ReadProcessMemoryto read any memory address from the process. If you are an administrator or have debug privilege you will be able to open any process with maximal access rights, you need only to enable SeDebugPrivilegebefore (see for example http://support.microsoft.com/kb/131065).

要读取其他应用程序的内存，您需要至少以访问权限打开与OpenProcess 相关的进程，PROCESS_VM_READ然后使用ReadProcessMemory从进程中读取任何内存地址。如果您是管理员或具有调试权限，您将能够以最大访问权限打开任何进程，您只需要在启用SeDebugPrivilege之前启用（例如参见http://support.microsoft.com/kb/131065）。

If you don't know a much about the memory of the destination process you can just enumerate the memory blocks with respect of VirtualQueryEx(see How does one use VirtualAllocEx do make room for a code cave?as an example where I examine the program code. The program data you can examine in the same way).

如果您不太了解目标进程的内存，您可以仅枚举关于VirtualQueryEx的内存块（请参阅如何使用 VirtualAllocEx 为代码洞穴腾出空间？作为我检查程序代码的示例. 你可以用同样的方式检查程序数据）。

The most practical problem which I see is that you ask your question in too generalway. If you explain more what kind of the data you are looking for I could probably suggest you a better way. For example if you could see the data somewhere you could examine the corresponding windows and controls with respect of Spy++ (a part of Visual Studio Tools). The most important are the class of windows (or controls) and the messages which will be send at the moment when the most interesting window are displayed. You can also use Process Monitorto trace all file and registry access at the time when the windows with the interesting information will be displayed. At least at the beginning you should examine the memory of the process with ReadProcessMemoryat the moment when the data which you are looking for are displayed on the window.

我看到的最实际的问题是你问的问题太笼统了。如果你解释更多你正在寻找什么样的数据，我可能会建议你一个更好的方法。例如，如果您可以在某处看到数据，则可以检查与 Spy++（Visual Studio 工具的一部分）相关的相应窗口和控件。最重要的是窗口（或控件）的类以及在显示最有趣的窗口时将发送的消息。您还可以使用Process Monitor跟踪所有文件和注册表访问，以便在显示带有有趣信息的窗口时。至少在开始时，您应该使用ReadProcessMemory检查进程的内存当您要查找的数据显示在窗口上时。

If you will have no success in your investigations I'd recommend you to insert in your question more information.

如果您的调查没有成功，我建议您在问题中插入更多信息。

回答by Pontus Gagge

My primary advice is: try to find anyother method of integration than this. Even if you succeed, you'll be hostage to any kinds of changes in the target process, and possibly in the Windows O/S. What you are describing is behaviour most virus scanners should flag and hinder: if not now, then in the future.

我的主要建议是：尝试找到除此之外的任何其他集成方法。即使您成功了，您也将受制于目标进程中的任何类型的更改，也可能是 Windows 操作系统中的更改。您所描述的是大多数病毒扫描程序应该标记和阻止的行为：如果不是现在，则是将来。

That said, you can take a look at DLL injection. However, it sounds as if you're going to have to debug the heck out of the target process at the disassembly level: otherwise, how are you going to know what memory address to read?

也就是说，你可以看看DLL injection。但是，听起来好像您必须在反汇编级别对目标进程进行调试：否则，您将如何知道要读取的内存地址？

回答by user376403

I used to know the windows debugging API but it's long lost memory. How about using ollydbg:

我曾经知道 Windows 调试 API，但它早已失去记忆。如何使用ollydbg：

http://www.ollydbg.de/

http://www.ollydbg.de/

And controlling that with both ollydbg script and autoit?

并使用 ollydbg 脚本和 autoit 来控制它？

回答by mpeterson

Sounds interesting... but very difficult. Since you say this is a 'one-off', what about something like this instead?

听起来很有趣……但非常困难。既然你说这是“一次性”，那么像这样的事情呢？

• Take a screenshot of this application.
• Run the screenshot through an OCR program
• If you are able to read the text you are looking for in a predictable way, you're halfway there!

• 截取此应用程序的屏幕截图。
• 通过 OCR 程序运行屏幕截图
• 如果您能够以可预测的方式阅读您正在寻找的文本，那么您就成功了一半！

So now if you can read a OCR'd screenshot of your application, it is a simple matter of writing a program that does the following:

因此，现在如果您可以阅读应用程序的 OCR 屏幕截图，那么编写一个执行以下操作的程序就很简单了：

• Scripts the steps to get the data on the screen
• Creates a screenshot of the data in question
• Runs it through an OCR program like Microsoft Office Document Imaging
• Extracts the relevant text and does 'whatever' with it.

• 编写在屏幕上获取数据的步骤
• 创建相关数据的屏幕截图
• 通过像Microsoft Office Document Imaging这样的 OCR 程序运行它
• 提取相关文本并对其执行“任何操作”。

I have done something like this before with pretty good results, but I would say it is a fragile solution. If the application changes, it stops working. If the OCR can't read the text, it stops working. If the OCR reads the wrong text, it might do worse things than stop working...

我以前做过类似的事情，结果很好，但我会说这是一个脆弱的解决方案。如果应用程序发生更改，它将停止工作。如果 OCR 无法读取文本，它将停止工作。如果 OCR 读取错误的文本，它可能会做比停止工作更糟糕的事情......

As the other posters have said, reaching into memory and pulling out data is a pretty advanced topic... kudos to you if you can figure out a way to do that!

正如其他海报所说，进入内存并提取数据是一个非常高级的话题......如果你能找到一种方法来做到这一点，那么恭喜你！

回答by Fehr

I know this may not be a popular answer, due to the nature of what this software is used for, but programs like CheatEngineand ArtMoneyallow you to search through all the memory reserved by a process for a given value, then refine the results till you find the address of the value you're looking for.

我知道这可能不是一个流行的答案，由于该软件的用途的性质，但是像CheatEngine和ArtMoney这样的程序允许您搜索进程为给定值保留的所有内存，然后细化结果直到您找到了您要查找的值的地址。

I learned this initially while trying to learn how to better protect my games after coming across a trainer for one of them, but have found the technique occasionally useful when debugging.

我最初是在遇到其中一个训练师后尝试学习如何更好地保护我的游戏时了解到这一点的，但发现该技术在调试时偶尔有用。

Here is an example of the technique described above in use: https://www.youtube.com/watch?v=Nv04gYx2jMw&t=265

以下是使用上述技术的示例：https: //www.youtube.com/watch?v=Nv04gYx2jMw&t=265