C# 如何检索64位指针的内存地址？

我正在为一款支持32位和64位系统的flash游戏开发一款教练机

我试图返回指针的内存地址，以便使用内存地址更改值。在32位版本中，我可以做得非常好。但是，在64位版本中，它返回不正确的内存地址

培训师目前只支持Google Chrome。如果您使用的是32位trainer，Chrome必须是32位的。如果您使用的是64位trainer，Chrome必须是64位的

这是来自作弊引擎的32位指针信息：

下面的代码将成功检索32位指针的内存地址：

输出：

假的

83CAAA8

这是来自作弊引擎的64位指针信息：

下面的代码是我试图检索64位指针的内存地址的代码：

输出：

真的

四十八

---

如何检索64位指针的内存地址？

此处分配8个字节：

var buffer = new byte[8];
IntPtr bytesRead;

在这里你只看到了4条：

using System;
using System.Diagnostics;
using System.Linq;
using System.Runtime.InteropServices;

namespace Trainer
{
    internal class Program
    {
        [DllImport("kernel32.dll", SetLastError = true)]
        private static extern bool ReadProcessMemory(IntPtr process, IntPtr baseAddress, [Out] byte[] buffer, int size,
            out IntPtr bytesRead);

        public static int ReadInt32(IntPtr process, IntPtr baseAddress)
        {
            var buffer = new byte[4];
            IntPtr bytesRead;
            ReadProcessMemory(process, baseAddress, buffer, 4, out bytesRead);
            return BitConverter.ToInt32(buffer, 0);
        }

        private static ProcessModule GetProcessModule(Process process, string moduleName)
        {
            foreach (ProcessModule module in process.Modules)
            {
                if (module.ModuleName == moduleName)
                {
                    return module;
                }
            }
            return null;
        }

        public static int GetRealAddress(IntPtr process, IntPtr baseAddress, int[] offsets)
        {
            var address = baseAddress.ToInt32();
            foreach (var offset in offsets)
            {
                address = ReadInt32(process, (IntPtr)address) + offset;
            }
            return address;
        }

        private static void Main()
        {
            Console.WriteLine(Environment.Is64BitProcess);

            // Get the first Chrome process that contains a module named "pepflashplayer.dll".
            var chromeProcess =
                Process.GetProcessesByName("chrome")
                    .FirstOrDefault(
                        process =>
                            process.Modules.Cast<ProcessModule>()
                                .Any(module => module.ModuleName == "pepflashplayer.dll"));

            if (chromeProcess != null)
            {
                var flashPlayerModule = GetProcessModule(chromeProcess, "pepflashplayer.dll");
                var baseAddress = flashPlayerModule.BaseAddress.ToInt32() + 0x01035A80;
                var offsets = new[] { 0x80, 0xB8, 0x464, 0x28, 0x28 };

                var realAddress = GetRealAddress(chromeProcess.Handle, (IntPtr)baseAddress, offsets);
                Console.WriteLine(realAddress.ToString("X"));
                Console.ReadLine();
            }
        }
    }
}

<?xml version="1.0" encoding="utf-8"?>
<CheatTable>
  <CheatEntries>
    <CheatEntry>
      <ID>0</ID>
      <Description>"pointerscan result"</Description>
      <LastState Value="10000" RealAddress="2A0C3492B38"/>
      <VariableType>4 Bytes</VariableType>
      <Address>"pepflashplayer.dll"+01CB16E8</Address>
      <Offsets>
        <Offset>48</Offset>
        <Offset>3D8</Offset>
        <Offset>370</Offset>
        <Offset>7A8</Offset>
        <Offset>360</Offset>
      </Offsets>
    </CheatEntry>
  </CheatEntries>
</CheatTable>

using System;
using System.Diagnostics;
using System.Linq;
using System.Runtime.InteropServices;

namespace Trainer
{
    internal class Program
    {
        [DllImport("kernel32.dll", SetLastError = true)]
        private static extern bool ReadProcessMemory(IntPtr process, IntPtr baseAddress, [Out] byte[] buffer, int size,
            out IntPtr bytesRead);

        public static long ReadInt64(IntPtr process, IntPtr baseAddress)
        {
            var buffer = new byte[8];
            IntPtr bytesRead;
            ReadProcessMemory(process, baseAddress, buffer, 4, out bytesRead);
            return BitConverter.ToInt64(buffer, 0);
        }

        private static ProcessModule GetProcessModule(Process process, string moduleName)
        {
            foreach (ProcessModule module in process.Modules)
            {
                if (module.ModuleName == moduleName)
                {
                    return module;
                }
            }
            return null;
        }

        public static long GetRealAddress(IntPtr process, IntPtr baseAddress, int[] offsets)
        {
            var address = baseAddress.ToInt64();
            foreach (var offset in offsets)
            {
                address = ReadInt64(process, (IntPtr)address) + offset;
            }
            return address;
        }

        private static void Main()
        {
            Console.WriteLine(Environment.Is64BitProcess);

            // Get the first Chrome process that contains a module named "pepflashplayer.dll".
            var chromeProcess =
                Process.GetProcessesByName("chrome")
                    .FirstOrDefault(
                        process =>
                            process.Modules.Cast<ProcessModule>()
                                .Any(module => module.ModuleName == "pepflashplayer.dll"));

            if (chromeProcess != null)
            {
                var flashPlayerModule = GetProcessModule(chromeProcess, "pepflashplayer.dll");
                var baseAddress = flashPlayerModule.BaseAddress.ToInt64() + 0x01CB16E8;
                var offsets = new[] { 0x360, 0x7A8, 0x370, 0x3D8, 0x48 };

                var realAddress = GetRealAddress(chromeProcess.Handle, (IntPtr)baseAddress, offsets);
                Console.WriteLine(realAddress.ToString("X"));
                Console.ReadLine();
            }
        }
    }
}

var buffer = new byte[8];
IntPtr bytesRead;

ReadProcessMemory(process, baseAddress, buffer, 4, out bytesRead);