如何从 ReadProcessMemory 的输出中获取字符串

Question

这是我的代码片段。

Declare Function ReadProcessMemory Lib "kernel32" _
                              (ByVal hProcess As Long, _
                              ByVal lpBaseAddress As Long, _
                              lpBuffer As Any, _
                              ByVal nSize As Long, _
                              lpNumberOfBytesRead As Long) As Long

Dim bytearray As String * 65526
Dim GetWindowsFormsID

ReadProcessMemory(processHandle, bufferMem, ByVal bytearray, size, lp)
GetWindowsFormsID = ByteArrayToString(bytearray, retLength)

Function ByteArrayToString(bytes As String, length As Long) As String
    Dim retValStr As String
    Dim l As Long
    retValStr = String$(length + 1, Chr(0))
    l = WideCharToMultiByte(CP_ACP, 0, bytes, -1, retValStr, length + 1, Null, Null)
    ByteArrayToString = retValStr
End Function

调用 WideCharToMultiByte 时出现“94 null”错误。 但我确信字节不为空。

这是将此输出转换为字符串的确切过程吗？

Answer 1

好的，这已经解决了（还有这个问题）。 问题实际上是将 WideChar 字符串转换为 ANSI 字符串。 我使用 CopyMemory 而不是 WideCharToMultiByte。

Public Declare Sub CopyMemory Lib "kernel32" Alias "RtlMoveMemory" (Destination As Any, Source As Any, ByVal Length As Long)

Function ByteArrayToString(bytes As String, Length As Long) As String
    Dim retValStr As String
    retValStr = String(Length - 1, Chr$(0))
    CopyMemory ByVal StrPtr(retValStr), ByVal bytes, Length * 2
    ByteArrayToString = retValStr
End Function