public static object HEXPatternToString(WatchMemoryObject watchMemoryObject) { string hex = ""; foreach (byte b in watchMemoryObject.Data) { hex += string.Format("{0:x2} ", b); } return(hex); }
public static byte[] ReadProcessMemory(WatchMemoryObject watchMemoryObject) { byte[] buffer = new byte[watchMemoryObject.MaxSize]; ProcessData processData = watchMemoryObject.ProcessData; bool successful = ReadProcessMemory(processData.ProcessHandle, (UIntPtr)watchMemoryObject.BaseAddress, buffer, buffer.Length, IntPtr.Zero); if (!successful) { watchMemoryObject.LastError = string.Format("Could not read memory: {0}", Win32Error.GetLastWin32Error()); return(null); } return(buffer); }
private void AddWatch(ClientContext clientContext) { // Starting offset in 'data' int offset = sizeof(UInt32); // Remote processes don't have memory watching support, ignore their pleas if (clientContext.IsRemote) { return; } // Layout of the AddWatch data chunk: // - Length (4b), Type string (*b) // - Length (4b), Name string (*b) // - Root handle (categories) (4b) // - Cross-process handle (4b) // - Base ptr (8b) // - Max size (4b) int typeLength = BitConverter.ToInt32(clientContext.Data, offset); offset += sizeof(Int32); string typeString = Encoding.ASCII.GetString(clientContext.Data, offset, typeLength); offset += typeLength; int nameLength = BitConverter.ToInt32(clientContext.Data, offset); offset += sizeof(Int32); string nameString = Encoding.ASCII.GetString(clientContext.Data, offset, nameLength); offset += nameLength; UInt32 rootHandle = BitConverter.ToUInt32(clientContext.Data, offset); offset += sizeof(UInt32); UInt32 handle = BitConverter.ToUInt32(clientContext.Data, offset); offset += sizeof(UInt32); UInt64 basePtr = BitConverter.ToUInt64(clientContext.Data, offset); offset += sizeof(UInt64); UInt32 maxSize = BitConverter.ToUInt32(clientContext.Data, offset); offset += sizeof(UInt32); WatchMemoryObject watchMemoryObject = new WatchMemoryObject() { ProcessData = clientContext.ProcessData, BaseAddress = basePtr, Name = nameString, Type = typeString, MaxSize = maxSize, Handle = handle }; clientContext.ProcessData.AddWatchBaseObject(rootHandle, watchMemoryObject); if (WatchMemoryObjectAdd != null) { WatchMemoryObjectAdd(watchMemoryObject); } }
public object Convert(WatchMemoryObject watchMemoryObject) { if (!conversionFunctions.ContainsKey(watchMemoryObject.Type)) { return(null); } try { object result = conversionFunctions[watchMemoryObject.Type](watchMemoryObject); return(result); } catch (SystemException excpt) { return(string.Format("Conversion function threw an exception: {0}!", excpt.ToString())); } }
public static object UTF8StringToString(WatchMemoryObject watchMemoryObject) { return(Encoding.UTF8.GetString(watchMemoryObject.Data, 0, (int)watchMemoryObject.MaxSize)); }
public static object Float64ToString(WatchMemoryObject watchMemoryObject) { return(BitConverter.ToDouble(watchMemoryObject.Data, 0).ToString()); }
public static object ANSIStringToString(WatchMemoryObject watchMemoryObject) { return(Encoding.Default.GetString(watchMemoryObject.Data, 0, (int)watchMemoryObject.MaxSize)); }
public static object UInt64ToString(WatchMemoryObject watchMemoryObject) { return(BitConverter.ToUInt64(watchMemoryObject.Data, 0).ToString()); }
public static object UInt8ToString(WatchMemoryObject watchMemoryObject) { return(watchMemoryObject.Data[0].ToString()); }
public static object Int32ToString(WatchMemoryObject watchMemoryObject) { return(BitConverter.ToInt32(watchMemoryObject.Data, 0).ToString()); }
public static object Int8ToString(WatchMemoryObject watchMemoryObject) { return(((SByte)watchMemoryObject.Data[0]).ToString()); }
public static object BoolToString(WatchMemoryObject watchMemoryObject) { return(watchMemoryObject.Data[0] > 0 ? "true" : "false"); }