ReadProcessMemory是一个内存操作函数， 其作用为根据进程句柄读入该进程的某个内存空间；函数原型为BOOL ReadProcessMemory(HANDLE hProcess, LPCVOID lpBaseAddress, LPVOID lpBuffer, DWORD nSize, LPDWORD lpNumberOfBytesRead); 由布尔声明可以看出， 当函数读取成功时返回1， 失败则返回0， 具体参数含义将在下文中指出。

This function reads memory in a specified process. The entire area to be read must be accessible or the operation fails.

（1）hProcess

[in] Handle to the process whose memory is being read.

In Windows CE, any call to OpenProcess returns a process handle with the proper access rights.

进程句柄

（2）lpBaseAddress

[in] Pointer to the base address in the specified process to be read.

Before data transfer occurs, the system verifies that all data in the base address and memory of the specified size is accessible for read access. If so, the function proceeds; otherwise, the function fails.

内存地址

（3）lpBuffer

[out] Pointer to a buffer that receives the contents from the address space of the specified process.

接收的内容，缓冲区指针

（4）nSize

[in] Specifies the requested number of bytes to read from the specified process.

读取字节数

（5）lpNumberOfBytesRead

[out] Pointer to the number of bytes transferred into the specified buffer.

If lpNumberOfBytesRead is NULL, the parameter is ignored.

指向传输到指定缓冲区的字节数的指针。

如果lpNumberOfBytesRead为空，则忽略该参数

Nonzero indicates success.

Zero indicatesfailure.

To get extended error information, call GetLastError.

The function fails if the requested read operation crosses into an area of the process that is inaccessible.

Remarks

ReadProcessMemory copies data in the specified address range from the address space of the specified process into the specified buffer of the current process. The process whose address space is read is typically, but not necessarily, being debugged.

The entire area to be read must be accessible. If it is not, the function fails.

OS Versions: Windows CE 2.0 and later.

Header: Winbase.h.

Link Library: Coredll.lib, Nk.lib.

OpenProcess | WriteProcessMemory

---------------------------------------------------------------------------------------

ReadProcessMemory

实际应用

hProcess [in]远程进程句柄。 被读取者

pvAddressRemote [in]远程进程中内存地址。 从具体何处读取

pvBufferLocal [out]本地进程中内存地址. 函数将读取的内容写入此处

dwSize [in]要传送的字节数。要写入多少

pdwNumBytesRead [out]实际传送的字节数. 函数返回时报告实际写入多少

ReadProcessMemory读出数据，权限要大一些。下面这个打开进程的方式具备了 查询 读和写的权限

hProcess = OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_OPERATION | PROCESS_VM_READ | PROCESS_VM_WRITE, 0, ProcessId)

var

hProcess:HWND;

wltId:DWord;

hProcess:=OpenProcess(PROCESS_CREATE_THREAD + PROCESS_VM_OPERATION+ PROCESS_VM_WRITE, FALSE, wltId);

然后就要结合上面的程序来搜索了。只有当内存是处于被占用状态时才去读取其中的内容，而忽略空闲状态的内存。程序我就不在这儿写了，和上面那段差不多。只是把dwTotalCommit = dwTotalCommit + mi.RegionSize换成了读取内存以及搜索这一块内存的函数而已。

1.通过FindWindow读取窗体的句柄

2.通过GetWindowThreadProcessId读取查找窗体句柄进程的PID值

var

nProcId:DWord;

nProcId:=GetWindowThreadProcessId(hFound, @nProcId);

3.用OpenProcess(PROCESS_QUERY_INFORMATION Or PROCESS_VM_OPERATION Or PROCESS_VM_READ Or PROCESS_VM_WRITE, 0, ProcessId)打开查到PID值的进程. 此打开具备读取,写入,查询的权限

4.ReadProcessMemory读出指定的内存地址数据

例题：

ReadProcessMemory(dwProcessId, (LPVOID)数据地址, szPassBuff, sizeof(szPassBuff), 0);