PBYTE pFile2;//设置为全局,方便其他cpp访问void CDLG_Process::AnalysisPFile(){ //获取行列内容 DWORD dwPid; CString Pid = m_ctrlList_Process.GetItemText(row, 0); dwPid = _ttoi(Pid.GetBuffer());//_ttoi String->int Pid.ReleaseBuffer(); //获取第一个模块信息 HANDLE hModuleSnap = INVALID_HANDLE_VALUE; MODULEENTRY32 me32 = { sizeof(MODULEENTRY32) }; // 1. 创建一个模块相关的快照句柄 hModuleSnap = CreateToolhelp32Snapshot( TH32CS_SNAPMODULE, // 指定快照的类型 dwPid); // 指定进程 if (hModuleSnap == INVALID_HANDLE_VALUE) return; // 2. 通过模块快照句柄获取第一个模块信息 if (!Module32First(hModuleSnap, &me32)) { CloseHandle(hModuleSnap); return; } //内存操作 //1 得到进程的句柄 HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, dwPid); //2.2 开始读取 LPVOID lpBuffer = new LPVOID[me32.modBaseSize]; ReadProcessMemory(hProcess, me32.hModule, lpBuffer, me32.modBaseSize, NULL); pFile2 = (PBYTE)lpBuffer; //隐藏控件 ::ShowWindow(::GetDlgItem(::FindWindow(NULL, L"PE工具"), IDC_FilePath), SW_HIDE); ::ShowWindow(::GetDlgItem(::FindWindow(NULL,L"PE工具"), IDC_BUTTON_SecFile), SW_HIDE);}