Windows核心编程笔记第五篇（代码精读PVOID GetModulePreferredBaseAddr(DWORD dwProcessId, PVOID pvModuleRemote)）

 

 1PVOID GetModulePreferredBaseAddr(DWORD dwProcessId, PVOID pvModuleRemote) {
 2
 3   PVOID pvModulePreferredBaseAddr = NULL;
 4   IMAGE_DOS_HEADER idh;
 5   IMAGE_NT_HEADERS inth;
 6
 7   // Read the remote module's DOS header
 8   Toolhelp32ReadProcessMemory(dwProcessId,
 9      pvModuleRemote, &idh, sizeof(idh), NULL);
10
11
12   // Verify the DOS image header
13   //e_magic为DOS可执行文件标记
14   //#define IMAGE_DOS_SIGNATURE                 0x5A4D      // MZ   DOS文件
15   //#define IMAGE_OS2_SIGNATURE                 0x454E      // NE
16   //#define IMAGE_OS2_SIGNATURE_LE              0x454C      // LE
17   //#define IMAGE_VXD_SIGNATURE                 0x454C      // LE
18   //#define IMAGE_NT_SIGNATURE                  0x00004550  // PE00 Windows文件
19   if (idh.e_magic == IMAGE_DOS_SIGNATURE) {
20      // Read the remote module's NT header
21          // e_lfanew 是当前DOS头（pvModuleRemote）相对实际PE头标的相对偏移量，
22      Toolhelp32ReadProcessMemory(dwProcessId,
23         (PBYTE) pvModuleRemote + idh.e_lfanew, &inth, sizeof(inth), NULL);
24
25      // Verify the NT image header
26      if (inth.Signature == IMAGE_NT_SIGNATURE) {
27         // This is valid NT header, get the image's preferred base address
28         pvModulePreferredBaseAddr = (PVOID) inth.OptionalHeader.ImageBase;
29      }
30   }
31   return(pvModulePreferredBaseAddr);
32}

Toolhelp32ReadProcessMemory

 

The Toolhelp32ReadProcessMemory function copies memory allocated to another process into an application-supplied buffer.

//函数 Toolhelp32ReadProcessMemory 读取另外一个进程的内存带应用程序指定的缓冲区
BOOL WINAPI Toolhelp32ReadProcessMemory(  DWORD th32ProcessID,  LPCVOID lpBaseAddress,  LPVOID lpBuffer,  SIZE_T cbRead,  SIZE_T lpNumberOfBytesRead);

Parameters

th32ProcessID

[in] Identifier of the process whose memory is being copied. This parameter can be zero to copy the memory of the current process.

//将要读取的进程的表示,这个参数可为0，为0读取当前进程

lpBaseAddress

[in] Base address in the specified process to read. Before transferring any data, the system verifies that all data in the base address and memory of the specified size is accessible for read access. If this is the case, the function proceeds. Otherwise, the function fails.

//将要在制定的进程的哪个基地址读取.在传输任何数据前，系统将会验证在所有在基地址中的数据和指定的内存大小是否可读,如果可读方法运行，否则方法失败

lpBuffer

[out] Pointer to a buffer that receives the contents of the address space of the specified process.

//用于存储指定进程的地址空间内容的缓存区

cbRead

[in] Number of bytes to read from the specified process.

//要读取的bytes数

lpNumberOfBytesRead

[out] Number of bytes copied to the specified buffer. If this parameter is NULL, it is ignored.

//指定缓存区的大小，如果为Null则不限制大小

IMAGE_NT_HEADERS

 

The IMAGE_NT_HEADERS structure represents the PE header format.

typedef struct _IMAGE_NT_HEADERS {
DWORD Signature;
IMAGE_FILE_HEADER FileHeader;
IMAGE_OPTIONAL_HEADER OptionalHeader;} IMAGE_NT_HEADERS,
*PIMAGE_NT_HEADERS;

Members

Signature

A 4-byte signature identifying the file as a PE image. The bytes are "PE\0\0".

FileHeader

An IMAGE_FILE_HEADER structure that specifies the file header.

OptionalHeader

An IMAGE_OPTIONAL_HEADER structure that specifies the optional file header.