返回提交历史
Added
XFEExtension.NetCore.MemoryEditor.sln
+25
-0
Added
XFEExtension.NetCore.MemoryEditor/MemoryEditor.cs
+107
-0
Added
XFEExtension.NetCore.MemoryEditor/ProcessAccessFlags.cs
+19
-0
Added
XFEExtension.NetCore.MemoryEditor/XFEExtension.NetCore.MemoryEditor.csproj
+14
-0
XFEstudio/XFEExtension.NetCore.MemoryEditor
添加项目文件。
76d5959
代码差异
4 个文件
+165
-0
@@ -0,0 +1,25 @@
1
2
Microsoft Visual Studio Solution File, Format Version 12.00
3
# Visual Studio Version 17
4
VisualStudioVersion = 17.9.34728.123
5
MinimumVisualStudioVersion = 10.0.40219.1
6
Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "XFEExtension.NetCore.MemoryEditor", "XFEExtension.NetCore.MemoryEditor\XFEExtension.NetCore.MemoryEditor.csproj", "{DBFE2E7A-C727-4E8D-AD9E-83E7EA36F937}"
7
EndProject
8
Global
9
GlobalSection(SolutionConfigurationPlatforms) = preSolution
10
Debug|Any CPU = Debug|Any CPU
11
Release|Any CPU = Release|Any CPU
12
EndGlobalSection
13
GlobalSection(ProjectConfigurationPlatforms) = postSolution
14
{DBFE2E7A-C727-4E8D-AD9E-83E7EA36F937}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
15
{DBFE2E7A-C727-4E8D-AD9E-83E7EA36F937}.Debug|Any CPU.Build.0 = Debug|Any CPU
16
{DBFE2E7A-C727-4E8D-AD9E-83E7EA36F937}.Release|Any CPU.ActiveCfg = Release|Any CPU
17
{DBFE2E7A-C727-4E8D-AD9E-83E7EA36F937}.Release|Any CPU.Build.0 = Release|Any CPU
18
EndGlobalSection
19
GlobalSection(SolutionProperties) = preSolution
20
HideSolutionNode = FALSE
21
EndGlobalSection
22
GlobalSection(ExtensibilityGlobals) = postSolution
23
SolutionGuid = {5652406C-CF19-4708-BA94-E51808552081}
24
EndGlobalSection
25
EndGlobal
@@ -0,0 +1,107 @@
1
using System.Diagnostics;
2
using System.Runtime.InteropServices;
3
4
namespace XFEExtension.NetCore.MemoryEditor;
5
6
public partial class MemoryEditor
7
{
8
#region DLL引用
9
[LibraryImport("kernel32.dll")]
10
internal static partial nint OpenProcess(int dwDesiredAccess, [MarshalAs(UnmanagedType.Bool)] bool bInheritHandle, int dwProcessId);
11
12
[LibraryImport("kernel32.dll", SetLastError = true)]
13
[return: MarshalAs(UnmanagedType.Bool)]
14
internal static partial bool WriteProcessMemory(nint hProcess, nint lpBaseAddress, byte[] lpBuffer, uint nSize, out int lpNumberOfBytesWritten);
15
16
[LibraryImport("kernel32.dll")]
17
[return: MarshalAs(UnmanagedType.Bool)]
18
internal static partial bool ReadProcessMemory(nint hProcess, nint lpBaseAddress, [Out] byte[] lpBuffer, uint dwSize, out int lpNumberOfBytesRead);
19
#endregion
20
/// <summary>
21
/// 获取程序句柄
22
/// </summary>
23
/// <param name="processId">进程ID</param>
24
/// <param name="flags">权限</param>
25
/// <returns></returns>
26
public static nint GetProcessHandle(int processId, ProcessAccessFlags flags)
27
{
28
nint processHandle = OpenProcess((int)flags, false, processId);
29
return processHandle;
30
}
31
/// <summary>
32
/// 获取程序句柄
33
/// </summary>
34
///
35
/// <param name="flags">权限</param>
36
/// <returns></returns>
37
public static nint GetProcessHandle(string processName, ProcessAccessFlags flags)
38
{
39
nint processHandle = OpenProcess((int)flags, false, processId);
40
return processHandle;
41
}
42
43
public static T ReadMemory<T>(nint processHandle, nint address) where T : struct
44
{
45
unsafe
46
{
47
var size = sizeof(T);
48
var buffer = new byte[size];
49
ReadProcessMemory(processHandle, address, buffer, (uint)size, out _);
50
fixed (byte* pBuffer = buffer)
51
{
52
return Marshal.PtrToStructure<T>((nint)pBuffer);
53
}
54
}
55
}
56
57
// 写入进程内存
58
public static void WriteMemory(nint processHandle, nint address, byte[] buffer)
59
{
60
WriteProcessMemory(processHandle, address, buffer, (uint)buffer.Length, out _);
61
}
62
63
// 解析指针地址
64
public static nint ResolvePointerAddress(string processName, string moduleName, int firstAddress, int[] offsets, int size)
65
{
66
// 获取游戏进程
67
var gameProcess = GetGameProcessByName(processName);
68
if (gameProcess == null)
69
{
70
Console.WriteLine("游戏进程未找到！");
71
return nint.Zero;
72
}
73
74
// 获取模块基址
75
var moduleBaseAddress = GetModuleBaseAddress(gameProcess, moduleName);
76
if (moduleBaseAddress == nint.Zero)
77
{
78
Console.WriteLine($"未找到模块：{moduleName}");
79
return nint.Zero;
80
}
81
82
// 解析指针地址
83
var resolvedAddress = nint.Add(moduleBaseAddress, firstAddress);
84
foreach (int offset in offsets)
85
{
86
var longAddress = ReadMemory<long>(gameProcess.Handle, resolvedAddress);
87
var pointerValue = new nint(longAddress);
88
resolvedAddress = nint.Add(pointerValue, offset);
89
}
90
91
return resolvedAddress;
92
}
93
94
// 获取进程对象
95
public static Process? GetGameProcessByName(string processName)
96
{
97
Process[] processes = Process.GetProcessesByName(processName);
98
return processes.Length > 0 ? processes[0] : null;
99
}
100
101
// 获取模块基址
102
public static nint GetModuleBaseAddress(Process process, string moduleName)
103
{
104
var module = process.Modules.Cast<ProcessModule>().FirstOrDefault(m => m.ModuleName.Equals(moduleName, StringComparison.OrdinalIgnoreCase));
105
return module != null ? module.BaseAddress : nint.Zero;
106
}
107
}
@@ -0,0 +1,19 @@
1
namespace XFEExtension.NetCore.MemoryEditor;
2
3
[Flags]
4
public enum ProcessAccessFlags : uint
5
{
6
All = 0x001F0FFF,
7
Terminate = 0x00000001,
8
CreateThread = 0x00000002,
9
VirtualMemoryOperation = 0x00000008,
10
VirtualMemoryRead = 0x00000010,
11
VirtualMemoryWrite = 0x00000020,
12
DuplicateHandle = 0x00000040,
13
CreateProcess = 0x000000080,
14
SetQuota = 0x00000100,
15
SetInformation = 0x00000200,
16
QueryInformation = 0x00000400,
17
QueryLimitedInformation = 0x00001000,
18
Synchronize = 0x00100000
19
}
@@ -0,0 +1,14 @@
1
<Project Sdk="Microsoft.NET.Sdk">
2
3
<PropertyGroup>
4
<TargetFramework>net8.0</TargetFramework>
5
<ImplicitUsings>enable</ImplicitUsings>
6
<Nullable>enable</Nullable>
7
<AllowUnsafeBlocks>true</AllowUnsafeBlocks>
8
<Title>XFEExtension.NetCore.MemoryEditor</Title>
9
<Authors>XFEstudio</Authors>
10
<Company>寰宇朽力网络科技</Company>
11
<Description>内存读写工具</Description>
12
</PropertyGroup>
13
14
</Project>