读写64位程序源码部分需要自行修改

ret ＝ NtWow64QueryInformationProcess64 (ProcessHandle, 0, pbi64, 48, 0)
.如果真 (ret ＝ 0)
Alen ＝ 取文本长度 (ModuleName)
Ulen ＝ Alen × 2 ＋ 1
Namebuf ＝ 取空白字节集 (Ulen)
Name ＝ 取空白文本 (Alen)
NtWow64ReadVirtualMemory64 (ProcessHandle, pbi64.PebBaseAddress ＋ 24, ldr, 8, 0) ' ldr ＝ Read64bit (hProcess, pbi64.PebBaseAddress ＋ 24, 8)
NtWow64ReadVirtualMemory64 (ProcessHandle, ldr ＋ 24, ldr, 8, 0) ' ldr ＝ Read64bit (hProcess, ldr ＋ 24, 8)
.循环判断首 ()
NtWow64ReadVirtualMemory64 (ProcessHandle, ldr ＋ 48, ModuleHandle, 8, 0) ' ModuleHandle ＝ Read64bit (hProcess, ldr ＋ 48, 8)
.如果真 (ModuleHandle ＝ 0)
跳出循环 ()
.如果真结束
NtWow64ReadVirtualMemory64 (ProcessHandle, ldr ＋ 96, pName, 8, 0) ' pName ＝ Read64bit (hProcess, ldr ＋ 96, 8)
NtWow64ReadVirtualMemory64_Bin (ProcessHandle, pName, Namebuf, Ulen, 0)
WideCharToMultiByte (936, 0, Namebuf, Ulen, Name, Alen, “”, 0)
.如果真 (到小写 (Name) ＝ 到小写 (ModuleName))
返回 (ModuleHandle)
.如果真结束
NtWow64ReadVirtualMemory64 (ProcessHandle, ldr ＋ 8, ldr, 8, 0)
.循环判断尾 (ModuleHandle ≠ 0)

操作句柄 ＝ OpenProcess (#PROCESS_ALL_ACCESS, 0, 进程ID)
.如果真 (操作句柄 ＝ 0)
返回 ({ })
.如果真结束
读取数据 ＝ 取空白字节集 (要读取的长度)
ZwWow64ReadVirtualMemory64 (操作句柄, 内存地址, 读取数据, 要读取的长度, 0)
CloseHandle (操作句柄)
返回 (读取数据)