分类: C/C++
2008-03-14 15:36:35
BOOL GetPTE(PVOID objAddress, HANDLE hMapPhysicalMemory, HANDLE hSection, PTE& pte) { DWORD dwPhysMemBuf = (DWORD)hMapPhysicalMemory, dwAddress = (DWORD)objAddress; LPVOID pNewMapPhy = NULL; DWORD dwNewAddress = *((LPDWORD)(dwPhysMemBuf + (dwAddress >> 0x16) * 4)); if ((dwNewAddress & 0x000000ff) < 0x01) { return FALSE; } if ((dwNewAddress & 0x000000ff) < 0x80) { pNewMapPhy = MapViewOfFile(hSection, 4, 0, dwNewAddress & 0xFFFFF000, 0x1000); dwNewAddress = (dwAddress >> 0x0c) & 0x3ff; dwNewAddress = *((LPDWORD)((DWORD)pNewMapPhy + 4 * dwNewAddress)) & 0xFFFFF000; UnmapViewOfFile(pNewMapPhy); pNewMapPhy = NULL; } else { dwNewAddress = (dwNewAddress & 0xFFFFF000) + (dwAddress & 0x003ff000); } pNewMapPhy = MapViewOfFile(hSection, FILE_MAP_READ, 0, dwNewAddress, 0x1000); if (pNewMapPhy == NULL) { long lError = GetLastError(); return FALSE; } else { memcpy(&pte, (char *)pNewMapPhy + (dwAddress & 0x00000FFF), sizeof(PTE)); } UnmapViewOfFile(pNewMapPhy); return TRUE; }最后,我加上了一个Pid到程序名的转换函数:ProcessPidToName。具体程序思路依照ilsy的文章,实现可以参见我的源码。