Question

如何使用OpenProcess(PROCESS_ALL_ACCESS, False, pid)打开一个进程

RT.

Answer 1

1.首先要知道进程ID号(任务管理器,可以看到pid进程id,
这里是查找窗体名,再获得进程id)
2.打开进程
3.操作内存
4.关闭进程

'----添加个新工程----
'复制代码

Private Declare Function FindWindow Lib "user32" Alias "FindWindowA" (ByVal lpClassName As String, ByVal lpWindowName As String) As Long
Private Declare Function GetWindowThreadProcessId Lib "user32" (ByVal hwnd As Long, lpdwProcessId As Long) As Long
Private Declare Function OpenProcess Lib "kernel32" (ByVal dwDesiredAccess As Long, ByVal bInheritHandle As Long, ByVal dwProcessId As Long) As Long
Private Declare Function CloseHandle Lib "kernel32" (ByVal hObject As Long) As Long
Private Declare Function ReadProcessMemory Lib "kernel32.dll" (ByVal hProcess As Long, ByVal lpBaseAddress As Long, ByRef lpBuffer As Any, ByVal nSize As Long, ByRef lpNumberOfBytesWritten As Long) As Long
Private Const PROCESS_ALL_ACCESS = &H1F0FFF
Private Declare Function WriteProcessMemory Lib "kernel32" (ByVal hProcess As Long, ByVal lpBaseAddress As Any, lpBuffer As Any, ByVal nSize As Long, lpNumberOfBytesWritten As Long) As Long

Private hProcess As Long '存放进程句柄
Private Hwd As Long '储存 FindWindow 函数返回的句柄
Private Pid As Long

Private Sub Form_Load()

'代码
'找QQ2009主窗体
Hwd = FindWindow(vbNullString, "QQ2009")

If Hwd <> 0 Then
MsgBox "找到窗体"
Else
MsgBox "没找到窗体"
End
End If

'找QQ2009的进程
GetWindowThreadProcessId Hwd, Pid

'打开进程 (由进程ID打开进程)
hProcess = OpenProcess(PROCESS_ALL_ACCESS, 0, Pid)
If hProcess <> 0 Then
MsgBox "打开进程成功"

'进程/内存 操作
'ReadProcessMemory hProcess, ByVal &H1A003A0, life, 4, 0& '读进程 地址的值 (根据自己需要而定)
'WriteProcessMemory hProcess, ByVal &H3C2FDB6, Life3, 4, 0& '写进程 地址的值
Else
MsgBox "打开进程失败"
End If
'关闭进程
CloseHandle hProcess
End Sub