public static List <ProcessEntry32> GetProcess32List()
{
Process32.SetPrivilege(Class3.smethod_10(538), true);
Process.EnterDebugMode();
List <ProcessEntry32> list = new List <ProcessEntry32>();
IntPtr intPtr = Process32.CreateToolhelp32Snapshot(Process32.TH32CS_SNAPPROCESS, 0u);
if (intPtr != IntPtr.Zero)
{
ProcessEntry32 processEntry = default(ProcessEntry32);
processEntry.dwSize = (uint)Marshal.SizeOf(processEntry);
if (Process32.Process32First(intPtr, ref processEntry))
{
do
{
IntPtr intPtr2 = Marshal.AllocHGlobal((int)processEntry.dwSize);
Marshal.StructureToPtr(processEntry, intPtr2, true);
ProcessEntry32 item = (ProcessEntry32)Marshal.PtrToStructure(intPtr2, typeof(ProcessEntry32));
Marshal.FreeHGlobal(intPtr2);
list.Add(item);
}while (Process32.Process32Next(intPtr, ref processEntry));
}
Process32.CloseHandle(intPtr);
}
return(list);
}
public static System.Collections.Generic.List <ProcessEntry32> GetProcess32List()
{
SetPrivilege(Class3.smethod_10(0x21a), true);
Process.EnterDebugMode();
System.Collections.Generic.List <ProcessEntry32> list = new System.Collections.Generic.List <ProcessEntry32>();
IntPtr hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
if (hSnapshot != IntPtr.Zero)
{
ProcessEntry32 entry;
entry = new ProcessEntry32 {
dwSize = (uint)Marshal.SizeOf(entry)
};
if (Process32First(hSnapshot, ref entry))
{
do
{
IntPtr ptr = Marshal.AllocHGlobal((int)entry.dwSize);
Marshal.StructureToPtr(entry, ptr, true);
ProcessEntry32 item = (ProcessEntry32)Marshal.PtrToStructure(ptr, typeof(ProcessEntry32));
Marshal.FreeHGlobal(ptr);
list.Add(item);
}while (Process32Next(hSnapshot, ref entry));
}
CloseHandle(hSnapshot);
}
return(list);
}
public static string GetProcess32File(ProcessEntry32 lpProcess)
{
int nSize = 0x400;
StringBuilder lpBaseName = new StringBuilder(0x400);
IntPtr hProcess = OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_READ, 0, lpProcess.th32ProcessID);
GetModuleFileNameEx(hProcess, IntPtr.Zero, lpBaseName, 0x400);
if (lpBaseName.Length == 0)
{
GetProcessImageFileName(hProcess, lpBaseName, nSize);
}
CloseHandle(hProcess);
return(lpBaseName.ToString());
}
public static string GetProcess32File(ProcessEntry32 lpProcess)
{
int nSize = 1024;
StringBuilder stringBuilder = new StringBuilder(1024);
IntPtr intPtr = Process32.OpenProcess(Process32.PROCESS_QUERY_INFORMATION | Process32.PROCESS_VM_READ, 0, lpProcess.th32ProcessID);
Process32.GetModuleFileNameEx(intPtr, IntPtr.Zero, stringBuilder, 1024);
if (stringBuilder.Length == 0)
{
Process32.GetProcessImageFileName(intPtr, stringBuilder, nSize);
}
Process32.CloseHandle(intPtr);
return(stringBuilder.ToString());
}
public static byte[] ReadMemory(ProcessEntry32 process, int address, int length, out int bytesRead)
{
System.IntPtr intPtr = Process32.OpenProcess(Process32.PROCESS_ALL_ACCESS, 0, process.th32ProcessID);
byte[] result;
if (intPtr != System.IntPtr.Zero)
{
byte[] array = new byte[length];
Process32.ReadProcessMemory(intPtr, new System.IntPtr(address), array, length, out bytesRead);
Process32.CloseHandle(intPtr);
result = array;
}
else
{
bytesRead = 0;
result = new byte[0];
}
return(result);
}
public static string GetProcess32File(ProcessEntry32 lpProcess)
{
System.Text.StringBuilder stringBuilder = new System.Text.StringBuilder(260);
System.IntPtr intPtr = Process32.OpenProcess(Process32.PROCESS_QUERY_INFORMATION | Process32.PROCESS_VM_READ, 0, lpProcess.th32ProcessID);
Process32.GetModuleFileNameEx(intPtr, System.IntPtr.Zero, stringBuilder, 260);
if (stringBuilder.Length == 0)
{
Process32.GetProcessImageFileName(intPtr, stringBuilder, 260);
}
Process32.CloseHandle(intPtr);
string text = stringBuilder.ToString();
if (text.Contains("\\Device\\HardDiskVolume", true))
{
string[] logicalDrives = System.IO.Directory.GetLogicalDrives();
for (int i = 0; i < logicalDrives.Length; i++)
{
text = text.Replace("\\Device\\HarddiskVolume" + (i + 1) + "\\", logicalDrives[i]);
}
}
return(text);
}
public static System.Collections.Generic.List <ProcessEntry32> GetProcess32List()
{
System.Collections.Generic.List <ProcessEntry32> list = new System.Collections.Generic.List <ProcessEntry32>();
System.IntPtr intPtr = Process32.CreateToolhelp32Snapshot(Process32.TH32CS_SNAPPROCESS, 0u);
if (intPtr != System.IntPtr.Zero)
{
ProcessEntry32 processEntry = default(ProcessEntry32);
processEntry.dwSize = (uint)System.Runtime.InteropServices.Marshal.SizeOf(processEntry);
if (Process32.Process32First(intPtr, ref processEntry))
{
do
{
System.IntPtr intPtr2 = System.Runtime.InteropServices.Marshal.AllocHGlobal((int)processEntry.dwSize);
System.Runtime.InteropServices.Marshal.StructureToPtr(processEntry, intPtr2, true);
ProcessEntry32 item = (ProcessEntry32)System.Runtime.InteropServices.Marshal.PtrToStructure(intPtr2, typeof(ProcessEntry32));
System.Runtime.InteropServices.Marshal.FreeHGlobal(intPtr2);
list.Add(item);
}while (Process32.Process32Next(intPtr, ref processEntry));
}
Process32.CloseHandle(intPtr);
}
return(list);
}
public static byte[] ReadMemory(ProcessEntry32 process, int address, int length, out int bytesRead)
{
return(ReadMemory(process.th32ProcessID, address, length, out bytesRead));
}
public static extern bool Process32Next(IntPtr hSnapshot, ref ProcessEntry32 lppe);
public static extern bool Process32First(System.IntPtr hSnapshot, ref ProcessEntry32 lppe);
