Example #1
0
            protected List <Byte[]> GetBytes(Int32 size, Int32 offset)
            {
                Process.EnterDebugMode();

                List <IntPtr> processHandles;
                var           bytes    = new List <Byte[]>();
                var           pointers = GetPointers(out processHandles);

                for (var i = 0; i < pointers.Count; i++)
                {
                    bytes.Add(new Byte[size]);

                    if (pointers[i] != IntPtr.Zero)
                    {
                        var buffer    = new Byte[size];
                        var bytesRead = UIntPtr.Zero;

                        WINAPI.ReadProcessMemory(processHandles[i], IntPtr.Add(pointers[i], offset), buffer, (UIntPtr)size, ref bytesRead);
                        if (!this.IgnoreException)
                        {
                            Int32 systemErrorCode = Marshal.GetLastWin32Error();
                            if (systemErrorCode != 0)
                            {
                                throw new Win32ErrorException(systemErrorCode);
                            }
                        }

                        for (var x = 0; x < buffer.Length; x++)
                        {
                            (bytes[i])[x] = buffer[x];
                        }
                    }
                }

                CloseHandles(processHandles);
                Process.LeaveDebugMode();
                return(bytes);
            }
Example #2
0
            protected List <IntPtr> GetPointers(out List <IntPtr> processHandles)
            {
                processHandles = GetHandles();
                List <IntPtr> pointers;

                if (this.address == null)
                {
                    pointers = this.GetModuleBaseAddress(this.moduleName);
                }
                else
                {
                    pointers = new List <IntPtr>();
                    for (var i = 0; i < processHandles.Count; i++)
                    {
                        pointers.Add((IntPtr)this.address);
                    }
                }

                for (var i = 0; i < processHandles.Count; i++)
                {
                    if (processHandles[i] == IntPtr.Zero)
                    {
                        pointers[i] = IntPtr.Zero;
                    }
                    else
                    {
                        if ((this.Offsets != null) && (this.Offsets.Length > 0))
                        {
                            var size      = UIntPtr.Size;
                            var buffer    = new Byte[size];
                            var bytesRead = UIntPtr.Zero;
                            foreach (var offset in this.Offsets)
                            {
                                WINAPI.ReadProcessMemory(processHandles[i], pointers[i], buffer, (UIntPtr)size, ref bytesRead);
                                if (!this.IgnoreException)
                                {
                                    Int32 systemErrorCode = Marshal.GetLastWin32Error();
                                    if (systemErrorCode != 0)
                                    {
                                        throw new Win32ErrorException(systemErrorCode);
                                    }
                                }

                                if (size == 8)
                                {
                                    pointers[i] = (IntPtr)(BitConverter.ToInt64(buffer, 0));
                                }
                                else
                                {
                                    pointers[i] = (IntPtr)(BitConverter.ToUInt32(buffer, 0));
                                }

                                if (pointers[i] == IntPtr.Zero)
                                {
                                    break;
                                }

                                pointers[i] = IntPtr.Add(pointers[i], offset);
                                //Debug
                                //Console.WriteLine(pointers[i]);
                            }
                        }
                    }
                }
                return(pointers);
            }