Using system; using system. collections. generic; using system. text; using system. runtime. interopservices; // The namespace windowsapplication1 {class WIN32API {public const int open_process_all = 2035711; Public const int page_readwrite = 4; Public const int process_create_thread = 2; public const int partition = 4; Public const int process_vm_operation = 8; Public const int process_vm_read = 256; Public const int process_vm_write = 32; private const int page_execute_readwrite = 0x4; private const int mem_commit = 4096; private const int mem_release = 0x8000; private const int mem_decommit = 0X4000; private const int process_all_access = 0x1f0fff; // find the form [dllimport ("user32.dll", entrypoint = "findwindow")] public extern static intptr findwindow (string lpclassname, string lpwindowname ); // obtain the target Process Handle function [dllimport ("user32.dll")] public extern static int getwindowthreadprocessid (INT hwnd, ref int lpdwprocessid); [dllimport ("user32.dll")] public extern static int getwindowthreadprocessid (intptr hwnd, ref int lpdwprocessid); // open the process [dllimport ("kernel32.dll")] public extern static int OpenProcess (INT dwdesiredaccess, int binherithandle, int dwprocessid); [dllimport ("kernel32.dll")] public extern static intptr OpenProcess (uint dwdesiredaccess, int binherithandle, uint dwprocessid ); // close the handle function [dllimport ("kernel32.dll", entrypoint = "closehandle")] public static extern int closehandle (INT hobject ); // READ memory [dllimport ("kernel32.dll")] public static extern int32 readprocessmemory (intptr hprocess, intptr lpbaseaddress, [In, out] Byte [] buffer, int size, out intptr lpnumberofbyteswritten); [dllimport ("kernel32.dll")] public static extern int32 readprocessmemory (INT hprocess, int lpbaseaddress, ref int buffer, // byte [] buffer, int size, int lpnumberofbyteswritten); [dllimport ("kernel32.dll")] public static extern int32 readprocessmemory (INT hprocess, int lpbaseaddress, byte [] buffer, int size, int lpnumberofbyteswritten ); // write memory [dllimport ("kernel32.dll")] public static extern int32 writeprocessmemory (intptr hprocess, intptr lpbaseaddress, [In, out] Byte [] buffer, int size, out intptr records); [dllimport ("kernel32.dll")] public static extern int32 writeprocessmemory (INT hprocess, int lpbaseaddress, byte [] buffer, int size, int lpnumberofbyteswritten ); // create thread [dllimport ("Kernel32", entrypoint = "createremotethread")] public static extern int createremotethread (INT hprocess, int timeout, int dwstacksize, int lpstartaddress, int lpparameter, int dwcreationflags, ref int lpthreadid); // open the memory space of the specified process [dllimport ("kernel32.dll")] public static extern system. int32 virtualallocex (system. intptr hprocess, system. int32 lpaddress, system. int32 dwsize, system. int16 flallocationtype, system. int16 flprotect); [dllimport ("kernel32.dll")] public static extern system. int32 virtualallocex (INT hprocess, int lpaddress, int dwsize, int flallocationtype, int flprotect); // release the memory space [dllimport ("kernel32.dll")] public static extern system. int32 virtualfreeex (INT hprocess, int lpaddress, int dwsize, int flallocationtype );}}