public void RegisterRegion(ulong baseAddress, ulong allocationBase, int allocationProtect, ulong regionSize, int state, int protect, int type) { if (diagnostics != null) { diagnostics.RegisterRegion(baseAddress, allocationBase, allocationProtect, regionSize, state, protect, type); } }
private void OnSeekOverun(object sender, SeekOverunEventArgs e) { ProcessExtensions.MEMORY_BASIC_INFORMATION memBasicInfo; ulong address = 0; switch (e.Location) { case ProcessSeekOrigin.BeginningOfProcessMemory: address = (ulong)e.Offset; break; case ProcessSeekOrigin.Begin: address = baseAddress + (ulong)e.Offset; break; case ProcessSeekOrigin.Current: address = baseAddress + (ulong)(baseStream.Position + e.Offset); break; case ProcessSeekOrigin.End: address = baseAddress + (ulong)(baseStream.Length + e.Offset); break; } e.Position = (long)address; e.ContinueBaseSeek = false; memBasicInfo = ProcessExtensions.GetMemoryInfo(hProcess, address); if (memBasicInfo.Protect == ProcessExtensions.AllocationProtectEnum.Readonly | memBasicInfo.Protect == ProcessExtensions.AllocationProtectEnum.ReadWrite | memBasicInfo.Protect == ProcessExtensions.AllocationProtectEnum.ExecuteRead | memBasicInfo.Protect == ProcessExtensions.AllocationProtectEnum.ExecuteReadWrite) { var offsetFromBase = (long)(address - baseAddress); e.MemoryAllocated = true; e.ContinueBaseSeek = true; e.BaseSeekOrigin = SeekOrigin.Begin; e.BaseOffset = offsetFromBase; if (memBasicInfo.AllocationBase.As <ulong>() != baseAddress && (offsetFromBase > systemInfo.AllocationGranularity || offsetFromBase < 0)) { if (!regions.ContainsKey((ulong)memBasicInfo.AllocationBase)) { regions.Add((ulong)memBasicInfo.AllocationBase, new ProcessBinaryReader(hProcess, (IntPtr)memBasicInfo.AllocationBase, (ulong)memBasicInfo.RegionSize)); processDiagnostics.RegisterRegion((ulong)memBasicInfo.BaseAddress, (ulong)memBasicInfo.AllocationBase, (int)memBasicInfo.AllocationProtect, (ulong)memBasicInfo.RegionSize, (int)memBasicInfo.State, (int)memBasicInfo.Protect, (int)memBasicInfo.Type); } e.OutOfRegionPosition = true; } else { e.OutOfRegionPosition = false; } } else { throw new Win32Exception(unchecked ((int)0xc0000005), string.Format("Attempt to read memory marked as {0} by {1}", memBasicInfo.Protect, this.GetType().FullName)); } }