Вставлю свои пять копеек: Просто класс для минимальной работы с памятью(немного не оптимизирован, но работает на ура): Основа Nt-функции(для разнообразия ) #pragma once#include <Windows.h>#include <tlHelp32.h>#include <subauth.h>typedef struct _CLIENT_ID{ PVOID UniqueProcess; PVOID UniqueThread;} CLIENT_ID, *PCLIENT_ID;typedef struct _OBJECT_ATTRIBUTES{ ULONG Length; HANDLE RootDirectory; PUNICODE_STRING ObjectName; ULONG Attributes; PVOID SecurityDescriptor; PVOID SecurityQualityOfService;} OBJECT_ATTRIBUTES, *POBJECT_ATTRIBUTES;typedef NTSTATUS(NTAPI* NTWRITEVIRTUALMEMORY)(HANDLE, PVOID, PVOID, ULONG, PULONG);typedef NTSTATUS(NTAPI* NTOPENPROCESS)(PHANDLE, ACCESS_MASK, POBJECT_ATTRIBUTES, PCLIENT_ID);typedef NTSTATUS(NTAPI* NTCLOSE)(HANDLE);typedef NTSTATUS(NTAPI *NTPROTECTVIRTUALMEMORY)(HANDLE , PVOID *, PULONG , ULONG , PULONG );//NtProtectVirtualMemoryclass cNtMemoryEdit{public: NTOPENPROCESS NtOpenProcess; NTCLOSE NtClose; NTWRITEVIRTUALMEMORY NtWriteVirtualMemory; NTPROTECTVIRTUALMEMORY NtProtectVirtualMemory; template <class cData> void NtWriteMemory(DWORD dwAddress, cData Value) { NtWriteVirtualMemory(m_pHandleProcess, (PVOID)dwAddress, &Value, sizeof(cData), NULL); } void NtWriteMemoryEx(DWORD dwAddress, char *Patch_Bts); cNtMemoryEdit(TCHAR * m_pNameProcess); virtual ~cNtMemoryEdit(); FARPROC newGPA(HMODULE Mod, TCHAR* fName); DWORD ProcessID(); DWORD GetProcessID(){ return this->m_pID; } HANDLE GetHandleProcess(){ return this->m_pHandleProcess; }private: TCHAR * m_pNameProcess; DWORD m_pID; HMODULE m_pNtdll; HANDLE m_pHandleProcess; CLIENT_ID m_pCID; OBJECT_ATTRIBUTES m_pATTRIBUTES; __int32 СharLength(char *chArray);};#define InitializeObjectAttributes(p, n, a, r, s) \{ \ (p)->Length = sizeof(OBJECT_ATTRIBUTES); \ (p)->RootDirectory = r; \ (p)->Attributes = a; \ (p)->ObjectName = n; \ (p)->SecurityDescriptor = s; \ (p)->SecurityQualityOfService = NULL; \}#include "cNtMemoryEdit.h"cNtMemoryEdit::cNtMemoryEdit(TCHAR * m_pNameProcess){ ZeroMemory(this, sizeof(cNtMemoryEdit)); ZeroMemory(&m_pATTRIBUTES, sizeof(m_pATTRIBUTES)); this->m_pNameProcess = m_pNameProcess; this->m_pNtdll = GetModuleHandle(__TEXT("ntdll.dll")); if (!this->m_pNtdll) this->m_pNtdll = LoadLibrary(__TEXT("ntdll.dll")); InitializeObjectAttributes(&m_pATTRIBUTES, NULL, 0, NULL, NULL); NtOpenProcess = (NTOPENPROCESS)newGPA(this->m_pNtdll, "NtOpenProcess"); NtClose = (NTCLOSE)newGPA(this->m_pNtdll, "NtClose"); NtWriteVirtualMemory = (NTWRITEVIRTUALMEMORY)newGPA(this->m_pNtdll, "NtWriteVirtualMemory"); NtProtectVirtualMemory = (NTPROTECTVIRTUALMEMORY)newGPA(this->m_pNtdll, "NtProtectVirtualMemory"); this->m_pID = ProcessID(); m_pCID.UniqueProcess = (HANDLE)this->m_pID; m_pCID.UniqueThread = 0; NtOpenProcess(&this->m_pHandleProcess, PROCESS_ALL_ACCESS, &m_pATTRIBUTES, &m_pCID);}void cNtMemoryEdit::NtWriteMemoryEx(DWORD dwAdress, char *pBYTE){ DWORD OldProtection; __int32 iSize = СharLength(pBYTE); NtProtectVirtualMemory(this->m_pHandleProcess, (PVOID*)dwAdress, (PULONG)iSize, PAGE_EXECUTE_READWRITE, &OldProtection); for (__int32 i = 0; i < iSize; i++) NtWriteMemory<BYTE>(dwAdress + i, pBYTE[i]); NtProtectVirtualMemory(this->m_pHandleProcess, (PVOID*)dwAdress, (PULONG)iSize, OldProtection, &OldProtection);}__int32 cNtMemoryEdit::СharLength(char *chArray){ for (__int32 iLength = 1; iLength < MAX_PATH; iLength++) if (chArray[iLength] == '\0') return iLength; return 0;}DWORD cNtMemoryEdit::ProcessID(){ DWORD pID = 0; HANDLE snapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0); PROCESSENTRY32 process; process.dwSize = sizeof(PROCESSENTRY32); if (Process32First(snapshot, &process)) { while (Process32Next(snapshot, &process)) { if (_stricmp(process.szExeFile, this->m_pNameProcess) == 0) { pID = process.th32ProcessID; break; } } } CloseHandle(snapshot); return pID;}FARPROC cNtMemoryEdit::newGPA(HMODULE Mod, TCHAR* fName){ ULONG Portable_Executable; PIMAGE_EXPORT_DIRECTORY EXPORT_DIRECTORY; PULONG RVAPointer; PUSHORT oTb_RVA; PULONG dwTbRVA; ULONG uReturn = 0; USHORT strTMP = 0; USHORT tmpINDEX; char * tmpName; ULONG Adress; ULONG size_CNT; if ((ULONG)fName <= 0xFFFF) strTMP = (USHORT)fName; if (Mod) { Portable_Executable = *(ULONG*)((ULONG)Mod + 0x3C) + (ULONG)Mod; EXPORT_DIRECTORY = (PIMAGE_EXPORT_DIRECTORY)(*(ULONG*)((ULONG)Portable_Executable + 0x78) + (ULONG)Mod); RVAPointer = (ULONG*)(EXPORT_DIRECTORY->AddressOfNames + (ULONG)Mod); oTb_RVA = (USHORT*)(EXPORT_DIRECTORY->AddressOfNameOrdinals + (ULONG)Mod); dwTbRVA = (ULONG*)(EXPORT_DIRECTORY->AddressOfFunctions + (ULONG)Mod); if (EXPORT_DIRECTORY->NumberOfNames > EXPORT_DIRECTORY->NumberOfFunctions) size_CNT = EXPORT_DIRECTORY->NumberOfNames; else size_CNT = EXPORT_DIRECTORY->NumberOfFunctions; for (USHORT i = 0; i < size_CNT; i++) { if (i < EXPORT_DIRECTORY->NumberOfFunctions) { tmpName = (char*)(RVAPointer[i] + (ULONG)Mod); tmpINDEX = oTb_RVA[i]; } else { tmpName = 0; tmpINDEX = i; } Adress = dwTbRVA[tmpINDEX] + (ULONG)Mod; if ((strTMP == tmpINDEX + EXPORT_DIRECTORY->Base) || (tmpName && !strcmp(tmpName, fName))) // wcscmp { uReturn = Adress; break; } } } return (FARPROC)uReturn;}cNtMemoryEdit::~cNtMemoryEdit(){ ZeroMemory(this, sizeof(cNtMemoryEdit)); NtClose(this->m_pHandleProcess);}#include "cNtMemoryEdit.h"cNtMemoryEdit *NtMemoryEdit = new cNtMemoryEdit("Test.exe");................NtMemoryEdit->NtWriteMemory<int>(0x024B3A40, 379);NtMemoryEdit->NtWriteMemory<float>(0x0000A40, 2.54f);NtMemoryEdit->NtWriteMemoryEx(0x0000000, "\x33\xFF\x84\xC0\x74\x07");