VB读写内存

原创

于 2024-03-09 18:32:24 发布 · 655 阅读

标签

#bash

收录于

这篇博客介绍了一种使用VB进行内存操作的方法，包括DLL注入和获取目标进程模块基址。通过调用Windows API函数，如OpenProcess、VirtualAllocEx、WriteProcessMemory等，实现了将DLL注入到指定进程并执行的功能。此外，还提供了获取进程模块句柄和基址的辅助函数。

Option Explicit

Private Sub InjectDLL(ByVal processId As Long, ByVal dllpath As String)
Dim hProcess As Long, hThread As Long, lpAddress As Long, dwBytesWritten As Long, hKernel32 As Long, LoadLibraryAddress As Long
hProcess = OpenProcess(&H1F0FFF, False, processId)
lpAddress = VirtualAllocEx(hProcess, 0, Len(dllpath) + 1, &H1000, &H4)
WriteProcessMemory hProcess, lpAddress, dllpath, Len(dllpath) + 1, dwBytesWritten
' 获取目标进程中的 Kernel32.dll 模块句柄
hKernel32 = GetModuleHandleA("Kernel32")
'获取函数地址
LoadLibraryAddress = GetProcAddress(hKernel32, "LoadLibraryA")
' 创建远程线程来加载 DLL
hThread = CreateRemoteThread(hProcess, 0, 0, LoadLibraryAddress, lpAddress, 0, 0)
If hThread = 0 Then
MsgBox "无法创建远程线程"
VirtualFreeEx hProcess, lpAddress, 0, &am