level 1
这个函数参数为28字节,正常情况下,在其他语言中声明为5个参数,4+8+4+8+4 = 28
与ReadProcessMemory 不同的就在地址,和读取长度,是8字节
VB6里面没有int64类型可以这样
1,声明为7个参数 4+4+4+4+4+4+4 = 28
declare function NtWow64ReadVirtualMemory64 lib "ntdll"(byval hprocess as long, _
byval laddr as long,byval waddr as long,buffer as any,byval lsize as long, _
byval wsize as long,ret as long) as long
laddr 为低32位地址,waddr高32位地址,lsize 读取长度低32位,wsize读取长度高32位,一般用不到设0,其他跟ReadProcessMemory 一样用。
2 用currency代替int64,声明为 6个参,4+8+4+4+4+4 = 28
declare function NtWow64ReadVirtualMemory64 lib "ntdll"(byval hprocess as long, _
byval lpaddress as currency,buffer as any,byval lsize as long, _
byval wsize as long,ret as long) as long
currency /10000 在内存中就是正确int64数值,现在R3 64位指针只用到47位,最高0x7FFFFFFFFFFF
CURRENCY是不可能益出的。不过传进去的时候需要除10000,比如这样
NtWow64ReadVirtualMemory64 hprocess,&H400000/10000,buffer,size,0,ret
3 跟其他语言一样声明为5个参,长度也使用currency 传入时一样要/10000
2020年09月25日 08点09分