public ProcessMemoryReader(Process process) { if (process == null) throw new ArgumentNullException("process"); if (process.HasExited) throw new ArgumentException("process"); _process = process; _minValidAddress = 0x00010000; _maxValidAddress = process.IsLargeAddressAware() ? 0xBFFF0000 : 0x7FFEFFFF; _pointerSize = process.Is64BitProcess() ? 8 : 4; }
/// <summary> /// Creates a userdump of a given process /// </summary> /// <param name="process">Process to dump</param> /// <param name="dumpFile">Where to write dump file</param> /// <returns>Whether or not the command completed successfully</returns> public static bool UserDump(Process process, string dumpFile) { string arch = (process.Is64BitProcess()) ? "x64" : "x86"; string userdump = Path.Combine(userDumpDir, arch, userDumpExe); if (!File.Exists(userdump)) return false; string stdout = RunCommand(userdump, string.Format("{0} \"{1}\"", process.Id, dumpFile)); return stdout.Contains("The process was dumped successfully."); }