Beispiel #1
0
    // Token: 0x06000099 RID: 153 RVA: 0x0000A608 File Offset: 0x00008808
    private void method_6()
    {
        if (this.intptr_0 == IntPtr.Zero)
        {
            throw new InvalidOperationException("Cannot dump process memory regions. No process loaded.");
        }
        this.dictionary_0.Clear();
        IntPtr   zero    = IntPtr.Zero;
        GStruct8 gstruct = default(GStruct8);

        Console.WriteLine("Handle: " + this.intptr_0.ToString());
        while ((long)zero < (long)this.intptr_1 && (long)zero >= 0L && GClass5.VirtualQueryEx(this.intptr_0, zero, out gstruct, (uint)Marshal.SizeOf(typeof(GStruct8))) != 0)
        {
            if (gstruct.int_2 == 4096)
            {
                if (gstruct.int_3 == 4 && (uint)gstruct.ulong_2 != 0u)
                {
                    byte[] array = new byte[(int)gstruct.ulong_2];
                    int    num   = 0;
                    if (!GClass5.ReadProcessMemory(this.intptr_0, new IntPtr((long)gstruct.ulong_0), array, (uint)gstruct.ulong_2, out num))
                    {
                        throw new Exception("Failed to read process memory at search " + gstruct.ulong_0.ToString() + ". Error code: " + Marshal.GetLastWin32Error().ToString());
                    }
                    this.dictionary_0.Add(new IntPtr((long)gstruct.ulong_0), array);
                }
            }
            zero = new IntPtr((long)(gstruct.ulong_0 + gstruct.ulong_2));
        }
    }
Beispiel #2
0
    // Token: 0x0600027E RID: 638 RVA: 0x01036BD4 File Offset: 0x01034DD4
    public static byte[] smethod_4(IntPtr intptr_0, IntPtr intptr_1, uint uint_0)
    {
        byte[] array = new byte[uint_0];

        uint num = 0u;

        if (!GClass5.ReadProcessMemory(intptr_0, intptr_1, array, array.Length, out num) || num != uint_0)
        {
            array = null;
        }
        return(array);
    }
Beispiel #3
0
    // Token: 0x06000280 RID: 640 RVA: 0x01036C48 File Offset: 0x01034E48
    public static string smethod_6(IntPtr intptr_0, IntPtr intptr_1, Encoding encoding_0 = null)
    {
        if (encoding_0 == null)
        {
            encoding_0 = Encoding.ASCII;
        }
        StringBuilder stringBuilder = new StringBuilder();

        byte[] array = new byte[256];
        uint   num   = 0u;
        int    num2  = -1;

        while (num2 < 0 && GClass5.ReadProcessMemory(intptr_0, intptr_1, array, array.Length, out num) && num > 0u)
        {
            intptr_1 = intptr_1.smethod_0((long)((ulong)num));
            int length = stringBuilder.Length;
            stringBuilder.Append(encoding_0.GetString(array, 0, (int)num));
            num2 = stringBuilder.ToString().IndexOf('\0', length);
        }
        return(stringBuilder.ToString().Substring(0, num2));
    }
Beispiel #4
0
    // Token: 0x0600009D RID: 157 RVA: 0x0000AA00 File Offset: 0x00008C00
    public byte[] method_10(IntPtr intptr_2, int int_1)
    {
        if (this.intptr_0 == IntPtr.Zero)
        {
            throw new InvalidOperationException("Cannot read process memory at " + intptr_2.ToString() + ". No process loaded.");
        }
        if (intptr_2 == IntPtr.Zero)
        {
            throw new ArgumentOutOfRangeException("Cannot read process memory. Invalid memory address.");
        }
        if (int_1 < 1)
        {
            throw new ArgumentOutOfRangeException("Cannot read process memory of size " + int_1.ToString() + ".");
        }
        byte[] array = new byte[int_1];
        int    num;

        if (!GClass5.ReadProcessMemory(this.intptr_0, intptr_2, array, (uint)array.Length, out num))
        {
            throw new Exception("Failed to read process memory at readMemory() " + intptr_2.ToString() + ". Error code: " + Marshal.GetLastWin32Error().ToString());
        }
        return(array);
    }