Using System;
using System.Collections.Generic;
using System.Text;
using System.Runtime.InteropServices; // this will certainly be the
命名空间WindowsApplication1
{
类win32API
{
public const int OPEN_PROCESS_ALL = 2035711;
public const int PAGE_READWRITE = 4;
public const int PROCESS_CREATE_THREAD = 2;
public const int PROCESS_HEAP_ENTRY_BUSY = 4;
public const int PROCESS_VM_OPERATION = 8;
public const int PROCESS_VM_READ = 256;
public const int PROCESS_VM_WRITE = 32;
Private const int PAGE_EXECUTE_READWRITE = 0x4;
private constant int MEM_COMMIT = 4096;
private const int MEM_RELEASE = 0x8000;
private const int MEM_DECOMMIT = 0x4000;
private const int PROCESS_ALL_ACCESS = 0x1F0FFF;
// Find the conventional
[DllImp ORT ( "User32.dll", EntryPoint = "FindWindow")]
public FindWindow external static IntPtr (
String lpClassName,
String lpWindowName
);
// Get a handle to the target program's function
[DllImp ORT ( "USER32.DLL")]
public static extern int GetWindowThreadProcessId (
int hwnd,
ref int lpdwProcessId
);
[DllImp ORT ( "USER32.DLL")]
public external static int GetWindowThreadProcessId (
HWND IntPtr,
REF lpdwProcessId int
);
// open the process
[DllImp ORT ( "kernel32.dll")]
public OpenProcess external static int (
int dwDesiredAccess,
int bInheritHandle,
int dwProcessId
);
[DllImp ORT ( "kernel32.dll")]
public OpenProcess external static IntPtr (
uint dwDesiredAccess ,
int the bInheritHandle,
uint. dwProcessId
);
// close the handle function
[DllImp ORT ( "Kernel32.dll", the EntryPoint = "the CloseHandle")]
public static extern int the CloseHandle (
int hObject
);
// read memory
[DllImp ORT ( "Kernel32.dll")]
public static external ReadProcessMemory Int32 (
IntPtr the hProcess,
IntPtr lpBaseAddress,
[the In, Out] byte [] Buffer,
int size,
OUT IntPtr the lpNumberOfBytesWritten
); duplicated code
[DllImp ORT ( "Kernel32.dll")]
public static external ReadProcessMemory Int32 (
int the hProcess,
int lpBaseAddress,
REF buffer int,
// byte [] buffer,
int size,
int the lpNumberOfBytesWritten
);
[DllImp ORT ( "Kernel32.dll") ]
public static external ReadProcessMemory Int32 (
int the hProcess,
int lpBaseAddress,
byte [] buffer,
int size,
int the lpNumberOfBytesWritten
);
// write memory
[DllImp ORT ( "Kernel32.dll")]
public static external WriteProcessMemory Int32 (
IntPtr the hProcess,
IntPtr lpBaseAddress,
[the In, Out] byte [] buffer,
int size,
OUT IntPtr the lpNumberOfBytesWritten
);
[DllImp ort(“ kernel32.dll”)]
公共静态外部Int32 WriteProcessMemory(
int hProcess,
int lpBaseAddress,
byte [] buffer,
int size,
int lpNumberOfBytesWritten
);
// create a thread
[DllImp ORT ( "kernel32", EntryPoint = "CreateRemoteThread")]
public static external CreateRemoteThread int (
int hProcess,
int lpThreadAttributes,
int dwStackSize,
int lpStartAddress,
int lpParameter,
int dwCreationFlags,
ref int lpThreadId
);
// open the specified process memory space
[DllImp ORT ( "Kernel32.dll")]
public static external VirtualAllocEx System.Int32 (
System.IntPtr hProcess,
System.Int32 lpAddress,
System.Int32 dwSize,
System.Int16 flAllocationType,
System.Int16 flProtect
);
[DllImp ORT ( "Kernel32.dll")]
public static external VirtualAllocEx System.Int32 The (
int the hProcess,
int lpAddress,
int the dwSize,
int flAllocationType,
int flProtect
);
// free up memory space
[DllImp ORT ( "Kernel32.dll")]
public static external VirtualFreeEx System.Int32 (
int hProcess,
int lpAddress,
int dwSize,
int flAllocationType
);
}
} Guangzhou surrogate [electric 13,802,269,370] Beijing surrogate consulting electrical 13802269370 surrogate [micro 13802269370] +