Esempio n. 1
0
        /// <summary>Dumps a chunk of memory to the given stream.</summary>
        /// <param name="address">The begin of the chunk.</param>
        /// <param name="size">The size of the chunk.</param>
        /// <param name="stream">The stream to dump to.</param>
        public void DumpRaw(IntPtr address, int size, Stream stream)
        {
            Contract.Requires(size >= 0);
            Contract.Requires(stream != null);

            var data = process.ReadRemoteMemory(address, size);

            stream.Write(data, 0, data.Length);
        }
Esempio n. 2
0
        public static string ReadRemoteStringUntilFirstNullCharacter(this IRemoteMemoryReader reader, IntPtr address, Encoding encoding, int length)
        {
            Contract.Requires(encoding != null);
            Contract.Requires(length >= 0);
            Contract.Ensures(Contract.Result <string>() != null);

            var data = reader.ReadRemoteMemory(address, length * encoding.GuessByteCountPerChar());

            // TODO We should cache the pattern per encoding.
            var index = PatternScanner.FindPattern(BytePattern.From(new byte[encoding.GuessByteCountPerChar()]), data);

            if (index == -1)
            {
                index = data.Length;
            }

            try
            {
                return(encoding.GetString(data, 0, Math.Min(index, data.Length)));
            }
            catch
            {
                return(string.Empty);
            }
        }
Esempio n. 3
0
        public static string ReadRemoteString(this IRemoteMemoryReader reader, IntPtr address, Encoding encoding, int length)
        {
            Contract.Requires(encoding != null);
            Contract.Requires(length >= 0);
            Contract.Ensures(Contract.Result <string>() != null);

            var data = reader.ReadRemoteMemory(address, length * encoding.GuessByteCountPerChar());

            try
            {
                var sb = new StringBuilder(encoding.GetString(data));
                for (var i = 0; i < sb.Length; ++i)
                {
                    if (sb[i] == '\0')
                    {
                        sb.Length = i;
                        break;
                    }
                    if (!sb[i].IsPrintable())
                    {
                        sb[i] = '.';
                    }
                }
                return(sb.ToString());
            }
            catch
            {
                return(string.Empty);
            }
        }
Esempio n. 4
0
        /// <summary>Tries to find and disassembles the instruction prior to the given address.</summary>
        /// <param name="process">The process to read from.</param>
        /// <param name="address">The address of the code.</param>
        /// <returns>The prior instruction.</returns>
        public DisassembledInstruction RemoteGetPreviousInstruction(IRemoteMemoryReader process, IntPtr address)
        {
            const int TotalBufferSize = 7 * MaximumInstructionLength;
            const int BufferShiftSize = 6 * MaximumInstructionLength;

            var buffer = process.ReadRemoteMemory(address - BufferShiftSize, TotalBufferSize);

            var handle = GCHandle.Alloc(buffer, GCHandleType.Pinned);

            try
            {
                var bufferAddress       = handle.AddrOfPinnedObject();
                var targetBufferAddress = bufferAddress + BufferShiftSize;

                var instruction = default(InstructionData);

                foreach (var offset in new[]
                {
                    6 * MaximumInstructionLength,
                    4 * MaximumInstructionLength,
                    2 * MaximumInstructionLength,
                    1 * MaximumInstructionLength,
                    14, 13, 12, 11, 10, 9, 8, 7, 6, 5, 4, 3, 2, 1
                })
                {
                    var currentAddress = targetBufferAddress - offset;

                    coreFunctions.DisassembleCode(currentAddress, offset + 1, address - offset, false, (ref InstructionData data) =>
                    {
                        var nextAddress = currentAddress + data.Length;
                        if (nextAddress.CompareTo(targetBufferAddress) > 0)
                        {
                            return(false);
                        }

                        instruction = data;

                        currentAddress = nextAddress;

                        return(true);
                    });

                    if (currentAddress == targetBufferAddress)
                    {
                        return(new DisassembledInstruction(ref instruction));
                    }
                }

                return(null);
            }
            finally
            {
                if (handle.IsAllocated)
                {
                    handle.Free();
                }
            }
        }
Esempio n. 5
0
        /// <summary>Disassembles the code in the given range (<paramref name="address"/>, <paramref name="maxLength"/>) in the remote process until the first 0xCC instruction.</summary>
        /// <param name="process">The process to read from.</param>
        /// <param name="address">The address of the code.</param>
        /// <param name="maxLength">The maximum maxLength of the code.</param>
        /// <returns>A list of <see cref="DisassembledInstruction"/> which belong to the function.</returns>
        public IReadOnlyList <DisassembledInstruction> RemoteDisassembleFunction(IRemoteMemoryReader process, IntPtr address, int maxLength)
        {
            Contract.Requires(process != null);
            Contract.Ensures(Contract.Result <IEnumerable <DisassembledInstruction> >() != null);

            var buffer = process.ReadRemoteMemory(address, maxLength);

            return(DisassembleFunction(buffer, address));
        }
Esempio n. 6
0
        /// <summary>Disassembles the code in the given range (<paramref name="address"/>, <paramref name="length"/>) in the remote process.</summary>
        /// <param name="process">The process to read from.</param>
        /// <param name="address">The address of the code.</param>
        /// <param name="length">The length of the code in bytes.</param>
        /// <param name="maxInstructions">The maximum number of instructions to disassemble. If <paramref name="maxInstructions"/> is -1, all available instructions get returned.</param>
        /// <returns>A list of <see cref="DisassembledInstruction"/>.</returns>
        public IReadOnlyList <DisassembledInstruction> RemoteDisassembleCode(IRemoteMemoryReader process, IntPtr address, int length, int maxInstructions)
        {
            Contract.Requires(process != null);
            Contract.Ensures(Contract.Result <IList <DisassembledInstruction> >() != null);

            var buffer = process.ReadRemoteMemory(address, length);

            return(DisassembleCode(buffer, address, maxInstructions));
        }
Esempio n. 7
0
        /// <summary>Dumps a module to the given stream. The section headers of the pe header get fixed to build a valid pe file.</summary>
        /// <param name="reader">The memory reader to use.</param>
        /// <param name="module">The module to dump.</param>
        /// <param name="stream">The stream to dump to.</param>
        public static void DumpModule(IRemoteMemoryReader reader, Module module, Stream stream)
        {
            Contract.Requires(module != null);
            Contract.Requires(stream != null);

            var data = reader.ReadRemoteMemory(module.Start, module.Size.ToInt32());

            SimplePeHeader.FixSectionHeaders(data);

            stream.Write(data, 0, data.Length);
        }
Esempio n. 8
0
        public static double ReadRemoteDouble(this IRemoteMemoryReader reader, IntPtr address)
        {
            var data = reader.ReadRemoteMemory(address, sizeof(double));

            return(reader.BitConverter.ToDouble(data, 0));
        }
Esempio n. 9
0
        public static float ReadRemoteFloat(this IRemoteMemoryReader reader, IntPtr address)
        {
            var data = reader.ReadRemoteMemory(address, sizeof(float));

            return(reader.BitConverter.ToSingle(data, 0));
        }
Esempio n. 10
0
        public static ulong ReadRemoteUInt64(this IRemoteMemoryReader reader, IntPtr address)
        {
            var data = reader.ReadRemoteMemory(address, sizeof(ulong));

            return(reader.BitConverter.ToUInt64(data, 0));
        }
Esempio n. 11
0
        public static int ReadRemoteInt32(this IRemoteMemoryReader reader, IntPtr address)
        {
            var data = reader.ReadRemoteMemory(address, sizeof(int));

            return(reader.BitConverter.ToInt32(data, 0));
        }
Esempio n. 12
0
        public static ushort ReadRemoteUInt16(this IRemoteMemoryReader reader, IntPtr address)
        {
            var data = reader.ReadRemoteMemory(address, sizeof(ushort));

            return(reader.BitConverter.ToUInt16(data, 0));
        }
Esempio n. 13
0
        public static byte ReadRemoteUInt8(this IRemoteMemoryReader reader, IntPtr address)
        {
            var data = reader.ReadRemoteMemory(address, sizeof(byte));

            return(data[0]);
        }