有时，有些软件有保护，看不到他程序内部是怎么一个样,如果想简单的把他的内存保存下来！
我写了一个简单的函数，调用一下就可以把DLL和EXE的内存里的信息全部导到文件里！到时再慢慢查吧！
uses
TlHelp32;
procedure GetDLLMemToFile;
var
PID: Dword;
Hand: THandle;
lppe: TModuleEntry32;
found: boolean;
File111: TFileStream;
dd, Add1, Add2, index: dword;
begin
Hand := CreateToolhelp32Snapshot(TH32CS_SNAPMODULE, GetCurrentProcessID,',',');
lppe.dwSize := SizeOf(lppe,',',');
found := Module32First(Hand, lppe,',',');
while found do
begin
File111 := TFileStream.Create('debug\' + extractfilename(lppe.szExePath), $FFFF,',',');
Add1 := dword(lppe.modBaseAddr,',',');
Add2 := Add1 + lppe.modBaseSize;
index := dword(lppe.modBaseAddr,',',');
while true do
begin
dd := Pdword(index)^;
File111.WriteBuffer(dd, 4,',',');
inc(index, 4,',',');
if index >= Add2 - 4 then break;
end;
File111.Destroy;
found := Module32Next(Hand, lppe,',',');
end;
CloseHandle(Hand,',','); // 释放快照句柄
end;
关键字词:
