ReadProcessMemory是一个内存操作函数， 其作用为根据进程句柄读入该进程的某个内存空间；函数原型为BOOL ReadProcessMemory(HANDLE hProcess, LPCVOID lpbaseAddress, LPVOID lpBuffer, DWORD nSize, LPDWORD lpNumberOfBytesRead); 由布尔声明可以看出， 当函数读取成功时返回1， 失败则返回0， 具体参数含义将在下文中指出。
ReadProcessMemory是一个内存操作函数， 其作用为根据进程句柄读入该进程的某个内存空间；函数原型为BOOL ReadProcessMemory(HANDLE hProcess, LPCVOID lpbaseAddress, LPVOID lpBuffer, DWORD nSize, LPDWORD lpNumberOfBytesRead); 由布尔声明可以看出， 当函数读取成功时返回1， 失败则返回0， 具体参数含义将在下文中指出。
This function reads memory in a specified process. The entire area to be read must be accessible or the operation fails.
BOOL ReadProcessMemory(HANDLE hProcess,LPCVOID lpbaseAddress,LPVOID lpBuffer,DWORD nSize,LPDWORD lpNumberOfBytesRead);ReadProcessMemory (hProcess, 十六到十 (“02C20100”), 矩阵 , 64, 0)//E语言读矩阵4*4
（1）hProcess
Handle to the process whose memory is being read.
In Windows CE, any call to OpenProcess returns a process handle with the proper access rights.
进程句柄
（2）lpbaseAddress
Pointer to the base address in the specified process to be read.
Before data transfer occurs, the system verifies that all data in the base address and memory of the specified size is accessible for read access. If so, the function proceeds; otherwise, the function fails.
内存地址
（3）lpBuffer
Pointer to a buffer that receives the contents from the address space of the specified process.
接收的内容，缓冲区指针
（4）nSize
Specifies the requested number of bytes to read from the specified process.
读取字节数
（5）lpNumberOfBytesRead
Pointer to the number of bytes transferred into the specified buffer.
If lpNumberOfBytesRead is NULL, the parameter is ignored.
指向传输到指定缓冲区的字节数的指针。
如果lpNumberOfBytesRead为空，则忽略该参数
Nonzero indicates success.
Zero indicatesfailure.
To get extended error information, call GetLastError.
The function fails if the requested read operation crosses into an area of the process that is inaccessible.
Remarks
ReadProcessMemory copies data in the specified address range from the address space of the specified process into the specified buffer of the current process. The process whose address space is read is typically, but not necessarily, being debugged.
The entire area to be read must be accessible. If it is not, the function fails.
OS Versions: Windows CE 2.0 and later.
Header: Winbase.h.
link Library: Coredll.lib, Nk.lib.
OpenProcess | WriteProcessMemory
---------------------------------------------------------------------------------------
ReadProcessMemory
BOOL ReadProcessMemory(HANDLE hProcess,PVOID pvAddressRemote,PVOIDpvBufferLocal, DWORD dwSize, PDWORDpdwNumBytesRead);
实际应用
hProcess 远程进程句柄。 被读取者
pvAddressRemote 远程进程中内存地址。 从具体何处读取
pvBufferLocal 本地进程中内存地址. 函数将读取的内容写入此处
dwSize 要传送的字节数。要写入多少
pdwNumBytesRead 实际传送的字节数. 函数返回时报告实际写入多少
ReadProcessMemory读出数据，权限要大一些。下面这个打开进程的方式具备了 查询 读和写的权限
hProcess = OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_OPERATION | PROCESS_VM_READ | PROCESS_VM_WRITE, 0, ProcessId)
var
hProcess:HWND;
wltId:DWord;
hProcess:=OpenProcess(PROCESS_CREATE_THREAD + PROCESS_VM_OPERATION+ PROCESS_VM_WRITE, FALSE, wltId);
然后就要结合上面的程序来搜索了。只有当内存是处于被占用状态时才去读取其中的内容，而忽略空闲状态的内存。程序我就不在这儿写了，和上面那段差不多。只是把dwTotalCommit = dwTotalCommit + mi.RegionSize换成了读取内存以及搜索这一块内存的函数而已。
1.通过FindWindow读取窗体的句柄
2.通过GetWindowThreadProcessId读取查找窗体句柄进程的PID值
var
nProcId:DWord;
nProcId:=GetWindowThreadProcessId(hFound, @nProcId);
3.用OpenProcess(PROCESS_QUERY_INFORMATION Or PROCESS_VM_OPERATION Or PROCESS_VM_READ Or PROCESS_VM_WRITE, 0, ProcessId)打开查到PID值的进程. 此打开具备读取,写入,查询的权限
4.ReadProcessMemory读出指定的内存地址数据
BOOL ReadProcessMemory(HANDLE hProcess, // 被读取进程的句柄；LPCVOID lpbaseAddress, // 读的起始地址；LPVOID lpBuffer, // 存放读取数据缓冲区；DWORD nSize, // 一次读取的字节数；LPDWORD lpNumberOfBytesRead // 实际读取的字节数；);
例题：
ReadProcessMemory(dwProcessId, (LPVOID)数据地址, szPassBuff, sizeof(szPassBuff), 0);
/// <summary>/// 从指定内存中读取字节集数据/// </summary>/// <param name="handle">进程句柄</param>/// <param name="address">内存地址</param>/// <param name="data">数据存储变量</param>/// <param name="size">长度</param>/// <param name="read">读取长度</param>private static extern void ReadProcessMemory(IntPtr handle, uint address, byte data, int size, int read);
温馨提示：
