/// <summary>
        /// Will load all the memory region information of the program into a list for faster scanning
        /// </summary>
        private void LoadMemoryRegions()
        {
            // the current address being scanned
            var address = new IntPtr();

            _memoryRegionsSortedIndices = new SortedList <Int32, int>();
            var count = 0;

            while (true)
            {
                // get the memory information for the first region
                var memInfo = new MemoryApi.MemoryBasicInformation();
                int result  = MemoryApi.VirtualQueryEx(_process.Handle, address, out memInfo,
                                                       (uint)Marshal.SizeOf(memInfo));

                // virtualqueryex will return 0 when we're out of range of the application
                if (0 == result)
                {
                    break;
                }

                // filter out any that don't have commit or aren't writable
                if (0 != (memInfo.State & MemCommit) && 0 != (memInfo.Protect & Writable) &&
                    0 == (memInfo.Protect & PageGuard))
                {
                    // store the information
                    MemoryRegions.Add(memInfo);
                    _memoryRegionsSortedIndices.Add(memInfo.BaseAddress.ToInt32(), count++);
                }

                // move to the next memory region
                address = new IntPtr(memInfo.BaseAddress.ToInt32() + memInfo.RegionSize);
            }
        }
Beispiel #2
0
        public void Data(uint address, byte[] data)
        {
            var current = new Region(address, (uint)data.Length);

            current.Intersection(inputRegion);
            current.Intersection(outputRegion);

            if (current.GetLength() > 0)
            {
                long sourceIndex      = current.GetAddressStart() - address;
                long destinationIndex = address - outputRegion.GetAddressStart();
                Array.Copy(data, (int)sourceIndex, buffer, (int)destinationIndex, current.GetLength());
                writtenRegions.Add(current);
            }
        }
Beispiel #3
0
 public void AddMemory(ulong address, ulong size, uint type)
 {
     MemoryRegions.Add(new MemoryRegion(address, size, type));
 }
Beispiel #4
0
 public void Data(uint address, byte[] data)
 {
     regions.Add(address, (uint)data.Length);
 }