public static List <MemoryBasicInformation> LoadRegions(SafeMemoryHandle processHandle, IntPtr startAddress, IntPtr endAddress,
MemoryAllocationState memoryAllocationState = MemoryAllocationState.MEM_COMMIT,
MemoryProtectionType memoryProtectionType = MemoryProtectionType.PAGE_ACCESSIBLE)
{
List <MemoryBasicInformation> regions = new List <MemoryBasicInformation>();
if (startAddress == endAddress)
{
return(regions);
}
if (endAddress == IntPtr.Zero)
{
endAddress = new IntPtr(0x7fffffffffff);
}
IntPtr seek = startAddress;
do
{
MemoryBasicInformation region = Native.Query(processHandle, seek, MarshalType <MemoryBasicInformation> .Size);
if ((region.State & memoryAllocationState) != 0 && (region.Protect & memoryProtectionType) != 0)
{
regions.Add(region);
}
seek = IntPtr.Add(region.BaseAddress, region.RegionSize.ToInt32());
}while (seek.ToInt64() < endAddress.ToInt64());
return(regions);
}
public MemoryProtectionOperation(IntPtr address, int size, int flNewProtect)
{
Address = address;
_size = size;
_type = MemoryProtectionType.Local;
VirtualProtect(Address, size, flNewProtect, out _oldProtect);
}
/// <summary>
/// Out of process memory protection operation.
/// </summary>
/// <param name="hProcess"></param>
/// <param name="address"></param>
/// <param name="size"></param>
/// <param name="flNewProtect"></param>
public MemoryProtectionOperation(IntPtr hProcess, IntPtr address, int size, MemoryProtectionType flNewProtect = MemoryProtectionType.PAGE_EXECUTE_READWRITE)
{
HProcess = hProcess;
Address = address;
Size = size;
FlNewProtect = flNewProtect;
OutOfProcess = true;
}
public MemoryProtectionOperation(IntPtr hProcess, IntPtr address, int size, int flNewProtect)
{
_hProcess = hProcess;
Address = address;
_size = size;
_type = MemoryProtectionType.External;
VirtualProtectEx(hProcess, Address, size, flNewProtect, out _oldProtect);
}
public MemoryProtection(SafeMemoryHandle processHandle, IntPtr address, int size,
MemoryProtectionType protection = MemoryProtectionType.PAGE_EXECUTE_READWRITE)
{
ProcessHandle = processHandle;
Address = address;
Size = size;
NewProtection = protection;
OldProtection = NativeMethods.ChangeMemoryProtection(ProcessHandle, Address, Size, NewProtection);
}
public static IntPtr Alloc([Optional] IntPtr address, int size,
MemoryProtectionType protect = MemoryProtectionType.PAGE_EXECUTE_READWRITE)
{
IntPtr memAddress = Imports.VirtualAlloc(address, size, MemoryAllocationState.MEM_COMMIT, protect);
if (memAddress == IntPtr.Zero)
{
throw new Win32Exception($"[Win32 Error: {Marshal.GetLastWin32Error()}] " +
$"Unable to allocate memory at 0x{address.ToString($"X{IntPtr.Size}")}[Size: {size}]");
}
return(memAddress);
}
public static MemoryProtectionType ChangeMemoryProtection(SafeMemoryHandle processHandle, IntPtr address, int size,
MemoryProtectionType newProtect = MemoryProtectionType.PAGE_EXECUTE_READWRITE)
{
MemoryProtectionType oldProtect;
if (!Imports.VirtualProtectEx(processHandle, address, size, newProtect, out oldProtect))
{
throw new Win32Exception($"[Win32 Error: {Marshal.GetLastWin32Error()}] " +
$"Unable to change memory protection of process handle " +
$"0x{processHandle.DangerousGetHandle().ToString("X")} at 0x{address.ToString($"X{IntPtr.Size}")}[Size: {size}] to {newProtect.ToString("X")}");
}
return(oldProtect);
}
public static IntPtr Allocate([Optional] IntPtr address, int size,
MemoryProtectionType protect = MemoryProtectionType.PAGE_EXECUTE_READWRITE)
{
var ret = Imports.VirtualAlloc(address, size, MemoryAllocationState.MEM_COMMIT, protect);
if (ret.Equals(0))
{
throw new Win32Exception(string.Format("[Error Code: {0}] Unable to allocate memory at 0x{1}[Size: {2}]",
Marshal.GetLastWin32Error(), address.ToString($"X{IntPtr.Size}"), size));
}
return(ret);
}
public static MemoryProtectionType ChangeMemoryProtection(IntPtr address, int size,
MemoryProtectionType newProtect =
MemoryProtectionType.PAGE_EXECUTE_READWRITE)
{
MemoryProtectionType oldProtect;
if (!Imports.VirtualProtect(address, size, newProtect, out oldProtect))
{
throw new Win32Exception(
$"[Error Code: {Marshal.GetLastWin32Error()}] Unable to change memory protection at 0x{address.ToString($"X{IntPtr.Size}")}[Size: {size}] to {newProtect.ToString("X")}");
}
return(oldProtect);
}
public static IntPtr Allocate(SafeMemoryHandle processHandle, [Optional] IntPtr address, int size,
MemoryProtectionType protect = MemoryProtectionType.PAGE_EXECUTE_READWRITE)
{
var ret = Imports.VirtualAllocEx(processHandle, address, size, MemoryAllocationState.MEM_COMMIT, protect);
if (ret.Equals(0))
{
throw new Win32Exception(string.Format(
"[Error Code: {0}] Unable to allocate memory to process handle 0x{1} at 0x{2}[Size: {3}]",
Marshal.GetLastWin32Error(), processHandle.DangerousGetHandle().ToString("X"),
address.ToString($"X{IntPtr.Size}"), size));
}
return(ret);
}
public static extern bool VirtualProtect(IntPtr address, UIntPtr size, MemoryProtectionType protectionType, out MemoryProtectionType oldProtectionType);
internal static extern IntPtr VirtualAllocEx(SafeMemoryHandle hProcess, uint dwAddress, int nSize,
MemoryAllocationType dwAllocationType, MemoryProtectionType dwProtect);
/// <summary>
/// Allocates memory inside the opened process.
/// </summary>
/// <param name="size">Number of bytes to allocate.</param>
/// <param name="allocationType">Type of memory allocation. See <see cref="MemoryAllocationType" />.</param>
/// <param name="protect">Type of memory protection. See <see cref="MemoryProtectionType" /></param>
/// <returns>Returns NULL on failure, or the base address of the allocated memory on success.</returns>
internal IntPtr AllocateMemory(int size, MemoryAllocationType allocationType = MemoryAllocationType.MEM_COMMIT,
MemoryProtectionType protect = MemoryProtectionType.PAGE_EXECUTE_READWRITE)
{
return(Imports.VirtualAllocEx(ProcessHandle, 0, size, allocationType, protect));
}
internal static extern IntPtr VirtualAllocEx(SafeProcessHandle processHandle, IntPtr baseAddress, int allocationSize, MemoryAllocationType allocationType, MemoryProtectionType protectionType);
internal static extern bool VirtualProtect(IntPtr lpAddress, int nSize, MemoryProtectionType flNewProtect,
out MemoryProtectionType lpflOldProtect);
internal static extern bool VirtualProtectEx(SafeMemoryHandle hProcess, IntPtr lpAddress, int nSize,
MemoryProtectionType flNewProtect, out MemoryProtectionType lpflOldProtect);
internal static extern IntPtr VirtualAllocEx(
SafeMemoryHandle hProcess,
[Optional] IntPtr lpAddress,
int dwSize,
MemoryAllocationState dwAllocationType,
MemoryProtectionType dwProtect);
internal static IntPtr AllocateVirtualMemory(SafeProcessHandle processHandle, IntPtr baseAddress, int allocationSize, MemoryProtectionType protectionType)
{
var regionAddress = Kernel32.VirtualAllocEx(processHandle, baseAddress, allocationSize, MemoryAllocationType.Commit | MemoryAllocationType.Reserve, protectionType);
if (regionAddress == IntPtr.Zero)
{
throw new PInvokeException("Failed to call VirtualAllocEx");
}
return(regionAddress);
}
public static extern IntPtr VirtualAllocEx(IntPtr hProcess, uint dwAddress, int nSize, MemoryAllocationType dwAllocationType, MemoryProtectionType dwProtect);
/// <summary>
/// Allocates a block of memory in the target process.
/// </summary>
/// <param name="hProcess">Handle to the process in which memory will be allocated.</param>
/// <param name="nSize">Number of bytes to be allocated. Default is 0x1000.</param>
/// <param name="dwAllocationType">The type of memory allocation. See <see cref="MemoryAllocType"/></param>
/// <param name="dwProtect">The memory protection for the region of pages to be allocated. If the pages are being committed, you can specify any one of the <see cref="MemoryProtectType"/> constants.</param>
/// <returns>Returns zero on failure, or the base address of the allocated block of memory on success.</returns>
public static IntPtr AllocateMemory(IntPtr hProcess, int nSize, MemoryAllocationType dwAllocationType, MemoryProtectionType dwProtect)
{
IntPtr allocatedMemory = Imports.VirtualAllocEx(hProcess, 0, nSize, dwAllocationType, dwProtect);
if (allocatedMemory == IntPtr.Zero)
{
throw new NullReferenceException();
}
return(allocatedMemory);
}
internal static extern bool VirtualProtectEx(SafeProcessHandle processHandle, IntPtr baseAddress, int protectionSize, MemoryProtectionType protectionType, out MemoryProtectionType oldProtectionType);
internal IntPtr AllocateVirtualMemory(int allocationSize, MemoryProtectionType protectionType)
{
return(AllocateVirtualMemory(IntPtr.Zero, allocationSize, protectionType));
}
/// <summary>
/// In process memory protection operation.
/// </summary>
/// <param name="address"></param>
/// <param name="size"></param>
/// <param name="flNewProtect"></param>
public MemoryProtectionOperation(IntPtr address, int size, MemoryProtectionType flNewProtect = MemoryProtectionType.PAGE_EXECUTE_READWRITE) :
this(IntPtr.Zero, address, size, flNewProtect)
{
OutOfProcess = false;
}
public static extern VirtualAllocRegion VirtualAlloc(IntPtr address, UIntPtr size, VirtualAllocType allocType, MemoryProtectionType protectionType);
internal static extern IntPtr VirtualAlloc([Optional] IntPtr lpAddress, int nSize, MemoryAllocationState dwAllocationType,
MemoryProtectionType dwProtect);
private static extern bool VirtualProtectEx(IntPtr hProcess, IntPtr lpAddress, int dwSize, MemoryProtectionType flNewProtect, out MemoryProtectionType lpflOldProtect);
internal static MemoryProtectionType ProtectVirtualMemory(SafeProcessHandle processHandle, IntPtr baseAddress, int protectionSize, MemoryProtectionType protectionType)
{
if (!Kernel32.VirtualProtectEx(processHandle, baseAddress, protectionSize, protectionType, out var oldProtectionType))
{
throw new PInvokeException("Failed to call VirtualProtectEx");
}
return(oldProtectionType);
}
internal static extern IntPtr VirtualAllocEx(SafeMemoryHandle hProcess, uint dwAddress, int nSize,
MemoryAllocationType dwAllocationType, MemoryProtectionType dwProtect);
internal static extern bool VirtualProtect(IntPtr baseAddress, int protectionSize, MemoryProtectionType protectionType, out MemoryProtectionType oldProtectionType);
