'''' =============================================================================
 '''' 允许直接写 MemPointer 指向的内存
 '''' 用和 Asm 一样的字节数定义 (DB, DW, DD, DX)
 '''' =============================================================================
 Sub WriteMem(ByVal MemPointer As Long, _
              SizeInBytes As e_BinaryData, _
              ByVal DataToWrite)
     CopyMemory ByVal MemPointer, VarPtr(DataToWrite), SizeInBytes
 End Sub

------------结束剪切---------------------------------------------------------------

用例：

通过内存为变量赋值：

 Dim ptrVariable As Long
 Dim xCounter As Long

 ptrVariable = VarPtr(ptrVariable)
 WriteMem ptrVariable, DefineWord, &HFFFF
 '''' 与 ptrVariable = &HFFFF 等价

读内存的内容，使用：

 ptrVariable = ReadMem(ptrVariable, DefineWord)

　　现在我们能够获得指针并访问它们了。但是如果你一步步跟着以上步骤看下来，你可能奇怪一条原本的 Visual Basic 赋值操作比这里介绍的直接内存赋值操作快得多。然而本文旨在指出可以使用 Visual Basic 访问内存，而这一点的主要意义不仅在于读取和分析变量，接下来，你可以通过获得内存地址简单地处理运行的 DLL。同时利用 modMemory.bas 和 PE (Portable Executable) 文件格式的知识，你可以分析 DLL 主体，看看它们是如何处理的。最好的是，可以获取它所有输出函数的列表；差点忘记，可以把它们 spy 出来或者干脆获取函数体的副本进行反汇编，比低级语言访问更多的内容，这也是 C 语言被称为工业标准的原因；现在你可以书写跟 C 表现相同的 Visual Basic 程序，祝你好运！

- Chris Vega [gwapo@models.com]

Accessing Memory by 32-bit Addresing in Windows using Visual Basic

July 6, 2001

Manila, Philippines

By: Chris Vega [gwapo@models.com]

When we talk about *real* Pointer and Memory Addressing, most of us thinks of Visual Basic limitations, ie, VB cannot access memory because VB has no pointer datatype for a variable declarations. This confusion grow even larger when a scenarios needed one *address* of a variable instead of its value, ie, from where in memory was that variable located into a virtual space of currently running process or a process or dynamic library.

Yes, there is actually *no* pointer variable for VB, but have you ever tried to turn a regular VB Datatype into a Pointer? do you think its not possible? well, think again, cause in Visual Basic (starting from release version 5), a serries of handy funtions is presented by Microsoft to turn this regular variables of yours into a pointer, these are:

 1] VarPtr - Returns the Address of a Variable or Array Element
   
           StrPtr - Returns the Address of String

  Variables in Visual Basic, except Strings are located into its
  Memory Location, you can get the Address of this variable by
  calling VarPtr Function. Strings however are stored as BSTR''''s,
  a pointer to a "pointer on array of characters", where you need
  StrPtr to have the address of "pointer to the array of characters"
  instead an address to BSTR if you used VarPtr in String.

  ex.
   Dim ptrMyPointer As Long
   Dim intMyInteger As Integer
   Dim strMyString As String * 25

   '''' A call

   ptrMyPointer = VarPtr(intMyInteger)

   '''' gives ptrMyPointer a 32-bit Address of the Variable
   '''' intMyInteger in Memory

   strMyString = "Address of Variable : " & Hex(ptrMyPointer)

   MsgBox strMyString

   '''' Next, a call

   ptrMyPointer = StrPtr(strMyString)

   '''' gives the Address of the First Element of the Array of
   '''' Character, ie, First letter of the String.

 2] VarPtrArray - Returns the Address of an Array of Variables
    VarPtrStringArray - Returns the Address of an Array of Strings

  Arrays in Visual Basic are store in SAFEARRAYs, and you need to
  use the function VarPtrArray to get the address of this array, but
  before you can use the function, you need to manually declare the
  function from msvbvm50.dll to your VB Application.

  ex.

   '''' for VB 5
   '''' ========
   Declare Function VarPtrArray _
                                         Lib "msvbvm50.dll" Alias "VarPtr" _
                    (Var() as Any) As Long

   '''' for VB 6
   '''' ========
   Declare Function VarPtrArray _
                                         Lib "msvbvm60.dll" Alias "VarPtr" _
                    (Var() as Any) As Long

   '''' The Call

   Dim lngSafeArrayAddress As Long
   Dim lngArrayOfLongs(6) As Long
   Dim i As Long

   Randomize
   For i = 0 to 6
    lngArrayOfLongs = Int(Rnd * &HFFFF)
   Next

   lngSafeArrayAddress = VarPtrArray(lngArrayOfLongs())

   '''' Returns the Safe Address of an Array lngArrayOfLongs, you
   '''' can simply use ''''em for *fast* sorting or many more!

  VarPtrStringArray however are more difficult to incorporate into
  you application since you need to create a TypeLibrary and manually
  refference the Library into VB Application. 

  To make a Type Library, you need a MIDL compiler, a CommandLine tool
  that compiles *.odl file into a Type Library,

  For VB5 Create a Text File and Save it to VB5StrPtr.odl with content:

  -------------Cut here--------------------------------------------------
  #define RTCALL _stdcall
  [
  uuid(6E814F00-7439-11D2-98D2-00C04FAD90E7),
  lcid (0), version(5.0), helpstring("VarPtrStringArray Support for VB5")
  ]
  library PtrLib
  {
  importlib ("stdole2.tlb");
  [dllname("msvbvm50.dll")]
  module ArrayPtr
     {
     [entry("VarPtr")]
     long RTCALL VarPtrStringArray([in] SAFEARRAY (BSTR) *Ptr);
     }
  }
  ----------End Cut here-------------------------------------------------

  And compile it with:
   MIDL /t VB5StrPtr.odl

  For VB6 Create a Text File and Save it to VB6StrPtr.odl with content:

  -------------Cut here--------------------------------------------------
  #define RTCALL _stdcall
  [
  uuid(C6799410-4431-11d2-A7F1-00A0C91110C3),
  lcid (0), version(6.0), helpstring("VarPtrStringArray Support for VB6")
  ]
  library PtrLib
  {
  importlib ("stdole2.tlb");
  [dllname("msvbvm60.dll")]
  module ArrayPtr
     {
     [entry("VarPtr")]
     long RTCALL VarPtrStringArray([in] SAFEARRAY (BSTR) *Ptr);
     }
  }
  ----------End Cut here-------------------------------------------------

  And compile it with:
   MIDL /t VB6StrPtr.odl

  Now, you have the Type Library, and Referrenced the Library to your VB
  Application, you can get the Array of Strings in this way:

  Dim MyArrayOfStrings(3) As String
  Dim AddressOfArray As Long
  MyArrayOfStrings(0)="Chris"
  MyArrayOfStrings(1)="Vega"
  MyArrayOfStrings(2)="gwapo@models.com"

  '''' A call
  Address

上一页  [1] [2] [3] [4]  下一页