Ejemplo n.º 1
0
    // Token: 0x06000099 RID: 153 RVA: 0x0000A608 File Offset: 0x00008808
    private void method_6()
    {
        if (this.intptr_0 == IntPtr.Zero)
        {
            throw new InvalidOperationException("Cannot dump process memory regions. No process loaded.");
        }
        this.dictionary_0.Clear();
        IntPtr   zero    = IntPtr.Zero;
        GStruct8 gstruct = default(GStruct8);

        Console.WriteLine("Handle: " + this.intptr_0.ToString());
        while ((long)zero < (long)this.intptr_1 && (long)zero >= 0L && GClass5.VirtualQueryEx(this.intptr_0, zero, out gstruct, (uint)Marshal.SizeOf(typeof(GStruct8))) != 0)
        {
            if (gstruct.int_2 == 4096)
            {
                if (gstruct.int_3 == 4 && (uint)gstruct.ulong_2 != 0u)
                {
                    byte[] array = new byte[(int)gstruct.ulong_2];
                    int    num   = 0;
                    if (!GClass5.ReadProcessMemory(this.intptr_0, new IntPtr((long)gstruct.ulong_0), array, (uint)gstruct.ulong_2, out num))
                    {
                        throw new Exception("Failed to read process memory at search " + gstruct.ulong_0.ToString() + ". Error code: " + Marshal.GetLastWin32Error().ToString());
                    }
                    this.dictionary_0.Add(new IntPtr((long)gstruct.ulong_0), array);
                }
            }
            zero = new IntPtr((long)(gstruct.ulong_0 + gstruct.ulong_2));
        }
    }
Ejemplo n.º 2
0
 public static extern int VirtualQueryEx(IntPtr intptr_2, IntPtr intptr_3, out GStruct8 gstruct8_0, uint uint_0);