0x00 相關說明：

Windows系統中，進程句柄是進程最重要的屬性之一，在應用層可以通過進程句柄直接對指定進程的內存空間進行讀寫。

0x01 通過進程名獲取進程句柄：

首先通過進程名得到進程ID：

1、 通過 CreateToolhelp32Snapshot 獲得當前系統中所有進程的快照

2、 通過 Process32First 判斷第一個進程的信息是否正常

3、 通過 Process32Next 結合循環遍歷所有的快照信息，使用進程名篩選出目標進程

通過進程ID獲取進程句柄：

使用 OpenProcess 可以通過進程ID獲取進程句柄

完整代碼如下：

HANDLE GetProcessHandle(LPCWSTR lpName)

{
DWORD dwPid = 0;
HANDLE hProcess = NULL;
HANDLE hProcessSnap;
PROCESSENTRY32 pe32;

// Take a snapshot of all processes in the system.
hProcessSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
if (hProcessSnap == INVALID_HANDLE_VALUE)
{
//printf("Error: CreateToolhelp32Snapshot (of processes)\r\n");

return NULL;
}

// Set the size of the structure before using it.
pe32.dwSize = sizeof(PROCESSENTRY32);

// Retrieve information about the first process,
// and exit if unsuccessful
if (!Process32First(hProcessSnap, &pe32))
{
//printf("Error: Process32First\r\n"); // show cause of failure

CloseHandle(hProcessSnap); // clean the snapshot object
return NULL;
}

// Now walk the snapshot of processes, and
// display information about each process in turn
int namelen = 200;
char name[201] = { 0 };
do
{
if (!wcscmp(pe32.szExeFile, lpName)) {
dwPid = pe32.th32ProcessID;
hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, dwPid);
break;
}

} while (Process32Next(hProcessSnap, &pe32));

CloseHandle(hProcessSnap);
return hProcess;
}

需要包含的頭文件：

#include <windows.h>
#include <TlHelp32.h>
#include <Psapi.h>

0x02 通過窗口標題獲取進程句柄：

大部分的Windows應用程序都有窗口，通過窗口標題獲取進程句柄非常簡單：

HANDLE GetProcessHandle(LPCWSTR lpName)
{
DWORD dwPid = 0;

HWND hWnd = FindWindowW(NULL, lpName);
if (hWnd == NULL) {
return;
}
GetWindowThreadProcessId(hWnd, &dwPid);
return OpenProcess(PROCESS_ALL_ACCESS, FALSE, dwPid);
}

0x03 封裝代碼：

可以將上面的代碼以及常用的進程讀寫封裝在一起，方便後續的使用：

新建 Process.h :

#pragma once

#include <stdio.h>
#include <windows.h>
#include <TlHelp32.h>
#include <Psapi.h>

class Process
{
public:
Process();
~Process();
Process(LPCWSTR lpName/*ProcessName/WindowTitle*/, BOOL bWindow = FALSE);

public:
BYTE ReadByte(LPCVOID addr, BYTE *data);
int ReadInt(LPCVOID addr, int *data);
long ReadLong(LPCVOID addr, long *data);
WORD ReadWord(LPCVOID addr, WORD *data);
DWORD ReadDword(LPCVOID addr, DWORD *data);
float ReadFloat(LPCVOID addr, float *data);
double ReadDouble(LPCVOID addr, double *data);
BYTE* ReadByteArray(LPCVOID addr, BYTE *data, size_t length);

BOOL WriteByte(LPVOID addr, BYTE data);
BOOL WriteInt(LPVOID addr, int data);
BOOL WriteLong(LPVOID addr, long data);
BOOL WriteWord(LPVOID addr, WORD data);
BOOL WriteDword(LPVOID addr, DWORD data);
BOOL WriteFloat(LPVOID addr, float data);
BOOL WriteDouble(LPVOID addr, double data);
BOOL WriteByteArray(LPVOID addr, BYTE *data, size_t length);

HMODULE GetModuleAddr(LPCWSTR lpModuleName);

public:
DWORD dwPid=0;
HANDLE hProcess=NULL;
};

新建 Process.cpp :

#include "Process.h"

Process::Process()
{
}

Process::~Process()
{
if(this->hProcess){
CloseHandle(this->hProcess);
}
}

Process::Process(LPCWSTR lpName/*ProcessName/WindowTitle*/, BOOL bWindow)
{
if (bWindow){
HWND hWnd = FindWindowW(NULL, lpName);
if(hWnd == NULL){
return;
}
GetWindowThreadProcessId(hWnd, &(this->dwPid));
this->hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, this->dwPid);
}
else {
HANDLE hProcessSnap;
PROCESSENTRY32 pe32;

// Take a snapshot of all processes in the system.
hProcessSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
if (hProcessSnap == INVALID_HANDLE_VALUE)
{
//printf("Error: CreateToolhelp32Snapshot (of processes)\r\n");
return;
}

// Set the size of the structure before using it.
pe32.dwSize = sizeof(PROCESSENTRY32);

// Retrieve information about the first process,
// and exit if unsuccessful
if (!Process32First(hProcessSnap, &pe32))
{
//printf("Error: Process32First\r\n"); // show cause of failure
CloseHandle(hProcessSnap); // clean the snapshot object
return;
}

// Now walk the snapshot of processes, and
// display information about each process in turn
int namelen = 200;
char name[201] = { 0 };
do
{
if (!wcscmp(pe32.szExeFile, lpName)) {
this->dwPid = pe32.th32ProcessID;
this->hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, this->dwPid);
break;
}

} while (Process32Next(hProcessSnap, &pe32));

CloseHandle(hProcessSnap);
}
}

BYTE Process::ReadByte(LPCVOID addr, BYTE *data)
{
BYTE ret;
ReadProcessMemory(this->hProcess, addr, &ret, sizeof(BYTE), NULL);
if(data != NULL)
* data = ret;
return ret;
}

int Process::ReadInt(LPCVOID addr, int *data)
{
int ret;
ReadProcessMemory(this->hProcess, addr, &ret, sizeof(int), NULL);
if (data != NULL)
* data = ret;
return ret;
}

long Process::ReadLong(LPCVOID addr, long *data)
{
long ret;
return ReadProcessMemory(this->hProcess, addr, data, sizeof(long), NULL);
if (data != NULL)
* data = ret;
return ret;
}

WORD Process::ReadWord(LPCVOID addr, WORD *data)
{
WORD ret;
ReadProcessMemory(this->hProcess, addr, &data, sizeof(WORD), NULL);
if (data != NULL)
* data = ret;
return ret;
}

DWORD Process::ReadDword(LPCVOID addr, DWORD *data)
{
DWORD ret;
ReadProcessMemory(this->hProcess, addr, &ret, sizeof(DWORD), NULL);
if (data != NULL)
* data = ret;
return ret;
}

float Process::ReadFloat(LPCVOID addr, float *data)
{
float ret;
ReadProcessMemory(this->hProcess, addr, &ret, sizeof(float), NULL);
if (data != NULL)
* data = ret;
return ret;
}

double Process::ReadDouble(LPCVOID addr, double *data)
{
double ret;
return ReadProcessMemory(this->hProcess, addr, &ret, sizeof(double), NULL);
if (data != NULL)
* data = ret;
return ret;
}

BYTE* Process::ReadByteArray(LPCVOID addr, BYTE *data, size_t length)
{
if (data == NULL)
exit(-1);
ReadProcessMemory(this->hProcess, addr, data, sizeof(BYTE)*length, NULL);
return data;
}

BOOL Process::WriteByte(LPVOID addr, BYTE data)
{
return WriteProcessMemory(this->hProcess, addr, &data, sizeof(BYTE), NULL);
}

BOOL Process::WriteInt(LPVOID addr, int data)
{
return WriteProcessMemory(this->hProcess, addr, &data, sizeof(int), NULL);
}

BOOL Process::WriteLong(LPVOID addr, long data)
{
return WriteProcessMemory(this->hProcess, addr, &data, sizeof(long), NULL);
}

BOOL Process::WriteWord(LPVOID addr, WORD data)
{
return WriteProcessMemory(this->hProcess, addr, &data, sizeof(WORD), NULL);
}

BOOL Process::WriteDword(LPVOID addr, DWORD data)
{
return WriteProcessMemory(this->hProcess, addr, &data, sizeof(DWORD), NULL);
}

BOOL Process::WriteFloat(LPVOID addr, float data)
{
return WriteProcessMemory(this->hProcess, addr, &data, sizeof(float), NULL);
}

BOOL Process::WriteDouble(LPVOID addr, double data)
{
return WriteProcessMemory(this->hProcess, addr, &data, sizeof(double), NULL);
}

BOOL Process::WriteByteArray(LPVOID addr, BYTE *data, size_t length)
{
return WriteProcessMemory(this->hProcess, addr, data, sizeof(BYTE)*length, NULL);
}

HMODULE Process::GetModuleAddr(LPCWSTR lpModuleName)
{
HANDLE hModuleSnap = INVALID_HANDLE_VALUE;
MODULEENTRY32 me32;
HMODULE hModule = 0;

// Take a snapshot of all modules in the specified process.
hModuleSnap = CreateToolhelp32Snapshot(TH32CS_SNAPMODULE, this->dwPid);
if (hModuleSnap == INVALID_HANDLE_VALUE)
{
//printf("Error: CreateToolhelp32Snapshot (of modules)\r\n");
return NULL;
}

// Set the size of the structure before using it.
me32.dwSize = sizeof(MODULEENTRY32);

// Retrieve information about the first module,
// and exit if unsuccessful
if (!Module32First(hModuleSnap, &me32))
{
//printf("Error: Module32First\r\n"); // show cause of failure
CloseHandle(hModuleSnap); // clean the snapshot object
return NULL;
}

// Now walk the module list of the process,
// and display information about each module
do
{
if (!wcscmp(lpModuleName, me32.szModule)) {
hModule = (HMODULE)me32.modBaseAddr;
CloseHandle(hModuleSnap);
return hModule;
}

} while (Module32Next(hModuleSnap, &me32));

CloseHandle(hModuleSnap);
return NULL;
}

WIN32API獲取進程句柄的2種方式