Exemple #1
0
        private void CheckMappedImages()
        {
            var ranges = process.QueryMemoryRangeInformation(IntPtr.Zero, 0x7FFFFFFF);

            foreach (var range in ranges)
            {
                if (!range.Protect.IsExecutable())
                {
                    continue;
                }
                if (range.Type != MemoryBackingType.Private)
                {
                    string backingFile = process.GetMappedFileName(range.BaseAddress);
                    backingFile = nameConverter.NativeNameToDosName(backingFile).ToLowerInvariant();
                    Console.WriteLine("{0,8:X8} {1} {2}", (int)range.BaseAddress, range.Protect.ToString(), backingFile);
                    if (!modules.ContainsKey(backingFile) && !modules.ContainsKey(Wow64Map(backingFile)))
                    {
                        Console.WriteLine("Unlisted!");
                    }
                }
                else
                {
                    Console.WriteLine("{0,8:X} {1}", (int)range.BaseAddress, range.Protect.ToString());
                }
            }
        }
Exemple #2
0
        protected override void AddPageToCache(IntPtr pageAddr, byte[] pageData)
        {
            var memInfos = process.QueryMemoryRangeInformation(pageAddr, pageSize);

            foreach (var memInfo in memInfos)
            {
                if (memInfo.Protect.IsWriteable())
                {
                    return;
                }
            }

            base.AddPageToCache(pageAddr, pageData);
        }